CVE-2026-70456 in Rsync
Summary
by MITRE • 08/13/2026
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability under discussion represents a critical out-of-bounds write flaw in rsync versions prior to 3.5.0, specifically within the read_args() function that operates at the core of the file synchronization protocol. This issue manifests when processing argument lists from remote senders, creating a scenario where malicious actors can manipulate heap memory layout through carefully crafted input sequences. The vulnerability stems from an insufficient boundary check during dynamic memory allocation for argument storage, leading to memory corruption that can potentially enable arbitrary code execution or system instability.
The technical implementation of this flaw involves the argv array allocation process where rsync pre-allocates memory for command line arguments based on expected argument count. When the number of arguments exactly matches the allocated buffer size, the code fails to account for the required NULL terminator that must be placed at the end of the argument vector. This results in a single byte write operation that overflows the allocated memory boundary by precisely one slot, causing adjacent heap memory regions to become corrupted. The flaw is particularly dangerous because it occurs during normal operational conditions when rsync processes legitimate argument lists from remote systems.
From an operational impact perspective, this vulnerability creates significant security risks for systems running affected rsync versions as it allows remote attackers to potentially manipulate heap metadata and memory structures. The corruption of adjacent heap memory can lead to unpredictable behavior including application crashes, data corruption, or more severe exploitation opportunities where attackers might leverage the memory corruption to execute arbitrary code. The vulnerability affects both client and server implementations of rsync, making it particularly concerning for systems that rely on rsync for backup operations, file synchronization, or remote system management.
Mitigation strategies should prioritize immediate patching of affected rsync installations to version 3.5.0 or later where the memory allocation boundary checking has been corrected. Network administrators should implement additional monitoring and intrusion detection measures to identify potential exploitation attempts through unusual argument patterns in rsync communications. The vulnerability aligns with CWE-787 Out-of-bounds Write, which specifically addresses buffer overflow conditions that write beyond allocated memory boundaries, and can be mapped to ATT&CK technique T1059 Command and Scripting Interpreter for potential exploitation pathways. Organizations should also consider implementing network segmentation and access controls around rsync services to limit potential attack surfaces and reduce the risk of unauthorized remote code execution through this vulnerability.