PT-2026-42052 · Rsync · Rsync

Omar Elsayed · Published 2026-05-20 · Updated 2026-05-24 · CVE-2026-43618

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3

Description An integer overflow exists in the compressed-token decoder due to a 32-bit signed counter that is not checked for overflow. A malicious sender can trigger this overflow, causing the receiver process to read and return data from outside the intended buffer bounds. This allows for the disclosure of process memory contents, such as environment variables, passwords, heap and stack data, and library memory pointers, which reduces the effectiveness of Address Space Layout Randomization (ASLR)—a security technique that randomly arranges the address space positions of key data areas—and facilitates further exploitation.

Recommendations Update to version 3.4.3 or later.

Fix

Out of bounds Read

Integer Overflow

Weakness Enumeration

CWE-125

CWE-190

Related Identifiers

CVE-2026-43618

OPENSUSE-SU-2026:10857-1

USN-8283-1

Affected Products

Rsync

References · 23

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45232 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29518 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43620 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-10158 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43618 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43618 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10857-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8283-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43618 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8283-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41035 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43617 · Vendor Advisory