File-copying Tool Vulnerability in Rsync Affects Multiple Versions

CVE-2026-44508

What is CVE-2026-44508?

Rsync, a widely-used file-copying tool, is susceptible to a memory corruption vulnerability due to an unchecked 32-bit signed counter in its compressed-token decoder. Attackers can exploit this weakness in versions prior to 3.4.3 to cause an overflow, leading to potential data leakage from the process's memory. This leakage may expose environment variables, passwords, and other sensitive pointers from the heap, stack, and libraries, thus undermining the effectiveness of Address Space Layout Randomization (ASLR) and paving the way for further exploitation. Users are strongly encouraged to upgrade to version 3.4.3 to mitigate these risks.

References