Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-70456rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
High 8.2
In plain English
A high-severity out-of-bounds write in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-daemon | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync-daemon | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync-daemon | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-rrsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync-rrsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| Alpine:v3.21 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70456 |
| Alpine:v3.22 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70456 |
| Alpine:v3.23 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70456 |
| Alpine:v3.24 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70456 |
| Debian:12 | rsync | no fix listed | DEBIAN-CVE-2026-70456 |
| Debian:13 | rsync | 3.5.0+ds1-0+deb13u1 | DEBIAN-CVE-2026-70456 |
| Debian:14 | rsync | 3.5.0+ds1-1 | DEBIAN-CVE-2026-70456 |
| Rocky Linux:10 | rsync | 0:3.5.0-3.el10_2 | RLSA-2026:67463 |
| Rocky Linux:8 | rsync | 0:3.1.3-28.el8_10 | RLSA-2026:74095 |
| Rocky Linux:9 | rsync | 0:3.2.7-1.el9_8 | RLSA-2026:67462 |
| Ubuntu:22.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70456 |
| Ubuntu:24.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70456 |
| Ubuntu:26.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70456 |
| Ubuntu:26.10 | rsync | no fix listed | UBUNTU-CVE-2026-70456 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RsyncProject | rsync | 3.0.1 – through 3.4.4 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- GitHub Security Advisory (GHSA-78jc-79jv-v6rw) vendor-advisory
- rsync 3.5.0 Release Notes release-notes
- https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args third-party-advisory