CVE-2026-44510 in rsync
Summary
by MITRE • 07/21/2026
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv_files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully wire-protocol-level, requires no special options on the victim, and works for both rsync:// URLs and remote-shell pulls; since inc_recurse is the protocol-30+ default, any client doing a normal recursive pull against an attacker-controlled URL is exposed. A malicious server sets CF_INC_RECURSE, sends a flist whose first sorted entry is not the leading "." directory (causing parent_ndx to be set to -1), then sends a transfer record with ndx = 0 and an iflag omitting ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference the result in f_name(). The impact is crash-only: the out-of-bounds read lands in glibc mmap chunk metadata and dereferences to an unmapped low address, producing a SEGV that cannot be leveraged into an exploit (confirmed on glibc x86-64 Linux; non-glibc allocators not audited). This issue is fixed in version 3.4.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The rsync vulnerability described represents a critical out-of-bounds array read condition that affects versions prior to 3.4.3, fundamentally compromising client system stability through malicious server interactions. This flaw exists within the receiver-side implementation of rsync's recv_files() function, creating a deterministic crash scenario that can be triggered entirely through the wire protocol without requiring any special client-side configurations or options. The vulnerability operates at the protocol level, making it particularly dangerous as it affects both rsync:// URLs and remote-shell pulls, with the inc_recurse functionality serving as the default protocol-30+ setting that exposes normal recursive pull operations to attack vectors.
The technical execution of this vulnerability relies on a specific sequence of protocol messages that manipulate internal data structures within rsync's file list processing. A malicious server can set the CF_INC_RECURSE flag and construct a file list where the first sorted entry is not the leading "." directory, which results in parent_ndx being set to -1. This manipulation creates a condition where subsequent transfer records with ndx = 0 and iflag omitting ITEM_TRANSFER cause the receiver to access memory locations that precede the allocated pointer array by exactly 8 bytes. The memory access occurs within the f_name() function, targeting glibc mmap chunk metadata and resulting in a segmentation fault when dereferencing an unmapped low address.
From a cybersecurity perspective, this vulnerability aligns with CWE-125 Out-of-Bounds Read and demonstrates characteristics consistent with ATT&CK technique T1203 Exploitation for Client Execution, though it operates at the boundary between network protocol handling and memory management rather than through traditional exploit chains. The impact remains crash-only as confirmed in glibc x86-64 Linux environments, where the out-of-bounds read does not reach executable code or provide a path to arbitrary code execution, but still represents a significant availability threat that can be leveraged for denial of service attacks against systems relying on rsync for file synchronization. The vulnerability's design flaw stems from inadequate bounds checking in the file list processing logic, specifically around how parent directory indices are handled during recursive file operations.
The remediation approach requires immediate deployment of rsync version 3.4.3 or later, which implements proper bounds checking and validation of directory index values to prevent the out-of-bounds memory access. System administrators should prioritize patching affected clients, particularly those that routinely perform recursive pulls from untrusted sources, as the vulnerability can be exploited through standard rsync operations without requiring any special client-side configuration or user interaction. Organizations relying on rsync for critical infrastructure synchronization should conduct thorough inventory assessments to identify all systems running vulnerable versions and implement monitoring for potential exploitation attempts targeting this specific memory access pattern.