CVE-2026-79775 in rclone
Summary
by MITRE • 08/25/2026
rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in rclone versions ranging from v1.72.0 through v1.74.4 represents a critical class of input validation failures within the software's archive backend, specifically targeting the SquashFS parser implementation which utilizes the github.com/diskfs/go-diskfs dependency. This flaw stems from an insufficient verification mechanism where attacker-controlled superblock and metadata values are processed without adequate bounds checking or sanity checks prior to their use in computational operations. The architectural design of rclone's :archive: remote allows users to expose storage backends via various protocols, including SFTP, thereby creating a potential attack surface for remote adversaries who can upload or modify SquashFS image files within the exposed directory structure. Because the parsing logic is implemented lazily, meaning that file system structures are not fully parsed until they are accessed, this vulnerability requires an active trigger event such as a victim user attempting to list contents of, descend into, or read from the malicious archive object. This lazy evaluation characteristic means that while the initial upload may succeed without issue, any subsequent interaction with the crafted artifact can lead to severe system instability or resource exhaustion depending on the specific malformed data present in the image header and metadata sections.
The technical exploitation vectors manifest primarily through three distinct failure modes within the parser logic, each leveraging different aspects of integer arithmetic and memory management errors. The first variant involves an integer division-by-zero panic triggered by a crafted superblock that specifies a zero block size. In standard SquashFS implementations, the block size is fundamental for calculating offsets and reading data blocks; when this value is absent or explicitly set to zero without validation, any subsequent calculation relying on dividing by this parameter results in a fatal runtime error that terminates the rclone process immediately. The second variant exploits an out-of-bounds slice panic caused by inode metadata containing invalid offset values. Here, the parser attempts to access memory locations based on offsets derived from untrusted input data that fall outside the allocated buffer boundaries. This type of vulnerability is classified under CWE-125 Out-of-bounds Read or CWE-787 Out-of-bounds Write depending on whether the operation involves reading metadata structure information or attempting to write parsed results, leading directly to application crashes and potential memory corruption scenarios in more complex processing paths.
The third variant presents a different risk profile characterized by sustained high CPU consumption due to an infinite or non-progressing loop triggered by truncated metadata streams. Unlike the first two variants which cause immediate termination of the service, this flaw leads to resource exhaustion where the parser enters a tight loop attempting to process incomplete or malformed data structures without proper exit conditions. This behavior aligns with CWE-835 Loop with Unreachable Exit Condition and can be leveraged for Denial-of-Service attacks that degrade system performance by consuming available CPU cycles indefinitely until manual intervention is required. The operational impact of these vulnerabilities is significant, particularly when rclone is deployed in server modes such as serve sftp. In such configurations, a single malicious file upload followed by an access attempt can crash the entire SFTP server instance, effectively denying service to all connected users and disrupting business operations that rely on stable remote storage access. This scenario maps directly to ATT&CK technique T1499 Endpoint Denial of Service, where attackers aim to disrupt availability rather than compromise confidentiality or integrity.
Mitigation strategies must prioritize immediate version upgrades as the primary defense mechanism. Organizations running affected versions should upgrade rclone to v1.75.0 or later, which contains patches for these input validation flaws in the SquashFS parser. For environments where upgrading is not immediately feasible, defensive measures include restricting access to :archive: remotes to trusted users only and implementing strict file type verification at the upload gateway level to prevent SquashFS images from being stored unless explicitly required by application logic. Additionally, deploying network-level monitoring tools that detect abnormal CPU usage patterns or frequent process restarts can help identify active exploitation attempts in real time. Security architects should also consider applying principle of least privilege to rclone service accounts and ensuring that any exposed storage backends are not directly accessible from untrusted networks without additional authentication and authorization layers. Regular auditing of uploaded file metadata and implementing automated scanning for malformed archive structures before they enter the parsing pipeline can further reduce the attack surface associated with these specific input validation weaknesses.