rsync 3.x OOB write in parse_size_arg before 3.5.0
CVE-2026-70457 Published on August 13, 2026
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
Vulnerability Analysis
CVE-2026-70457 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Incorrect Calculation of Buffer Size
The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-70457 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-70457
Want to know whenever a new CVE is published for Samba Rsync? stack.watch will email you.
Affected Versions
RsyncProject rsync:- Version 3.2.3, <= 3.4.4 is affected.
- Version 3.5.0 is unaffected.