Heap Out-of-Bounds Write Vulnerability in Rsync by Rsync Project

CVE-2026-70461

What is CVE-2026-70461?

Rsync versions before 3.5.0 are impacted by a heap out-of-bounds write vulnerability, allowing remote unauthenticated attackers to exploit a crafted files-from entry. This vulnerability facilitates the writing of an attacker-controlled byte past the end of a heap allocation, which can compromise the integrity of the rsync daemon module. Specifically, the flaw occurs in the add_implied_include() function, where the handling of backslashes leads to an incorrect buffer size calculation, enabling attackers to exploit this weakness effectively.

References