canonical ubuntu-linux CVE-2026-61548 in Canonical and Rsyslog Products
Published on September 18, 2026

Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data

product logo product logo
Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-61548 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Stack Overflow Vulnerability?

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CVE-2026-61548 has been classified to as a Stack Overflow vulnerability or weakness.


Products Associated with CVE-2026-61548

stack.watch emails you whenever new vulnerabilities are published in Canonical Ubuntu Linux or Rsyslog. Just hit a watch button to start following.

Canonical Ubuntu Linux
 
Rsyslog
 

Affected Versions

rsyslog Version >= 7.5.4, < 8.2606.0 is affected by CVE-2026-61548