CVE-2026-70461 in Rsync
Summary
by MITRE • 08/13/2026
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in rsync versions prior to 3.5.0 represents a critical heap out-of-bounds write flaw that exposes systems to remote code execution risks. This issue stems from improper buffer handling within the add_implied_include() function, which processes files-from entries during rsync operations. The flaw specifically manifests when attackers supply malicious input containing both interior and trailing backslashes in a files-from entry, creating conditions where the function undercounts the trailing backslash during buffer size calculations. This miscalculation results in insufficient memory allocation for the destination buffer, allowing an attacker to write one controlled byte beyond the allocated heap memory boundary.
The technical implementation of this vulnerability involves the manipulation of input parsing logic within rsync's daemon module functionality. When processing files-from entries, the system's buffer sizing algorithm fails to properly account for backslash characters in specific positional arrangements, leading to a classic buffer overflow condition. The under-counting behavior occurs because the function does not correctly handle the escape sequence interpretation for trailing backslashes, causing the destination buffer to be allocated with insufficient space to accommodate the full parsed content. This heap-based memory corruption creates opportunities for attackers to overwrite adjacent memory regions, potentially leading to arbitrary code execution or system compromise.
From an operational perspective, this vulnerability poses significant risks to systems running rsync daemon services, particularly those configured as read-only modules that remain accessible to unauthenticated users. Attackers can exploit this weakness without requiring authentication credentials, making the attack surface particularly broad for exposed rsync services. The impact extends beyond simple denial of service scenarios, as the out-of-bounds write could potentially be leveraged for privilege escalation or remote code execution depending on system configuration and memory layout. Systems that rely on rsync for file synchronization and backup operations are especially vulnerable when configured with default or permissive daemon settings.
Security mitigations for this vulnerability primarily involve immediate patching of affected rsync installations to versions 3.5.0 or later where the buffer handling logic has been corrected. Organizations should also implement network-level restrictions to limit access to rsync daemon services, particularly disabling unauthenticated access where possible. Monitoring systems should be configured to detect unusual files-from entry patterns that might indicate exploitation attempts, while regular security audits should verify proper rsync configuration settings and ensure that daemon modules are not unnecessarily exposed to external networks. The vulnerability aligns with CWE-121 heap-based buffer overflow issues and may map to ATT&CK technique T1059 for execution through command-line interfaces.
This flaw demonstrates the importance of thorough input validation and buffer management in network services, particularly those handling user-supplied data streams. The vulnerability highlights how seemingly minor parsing inconsistencies can create significant security implications, especially in widely deployed utilities like rsync that operate as fundamental network services across enterprise and cloud environments. Proper memory management practices including bounds checking and robust input sanitization are essential for preventing similar issues in other software components that handle dynamic data processing scenarios.