PT-2026-61730 · Rsyncproject · Rsync
CVE-2026-44510
·
Published
2026-07-20
·
Updated
2026-07-20
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully wire-protocol-level, requires no special options on the victim, and works for both rsync:// URLs and remote-shell pulls; since inc recurse is the protocol-30+ default, any client doing a normal recursive pull against an attacker-controlled URL is exposed. A malicious server sets CF INC RECURSE, sends a flist whose first sorted entry is not the leading "." directory (causing parent ndx to be set to -1), then sends a transfer record with ndx = 0 and an iflag omitting ITEM TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference the result in f name(). The impact is crash-only: the out-of-bounds read lands in glibc mmap chunk metadata and dereferences to an unmapped low address, producing a SEGV that cannot be leveraged into an exploit (confirmed on glibc x86-64 Linux; non-glibc allocators not audited). This issue is fixed in version 3.4.3.
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rsync