Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-70457rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
Medium 6.5
In plain English
A medium-severity out-of-bounds write in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-daemon | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync-daemon | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-rrsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync-rrsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| Alpine:v3.21 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70457 |
| Alpine:v3.22 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70457 |
| Alpine:v3.23 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70457 |
| Alpine:v3.24 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70457 |
| Debian:12 | rsync | no fix listed | DEBIAN-CVE-2026-70457 |
| Debian:13 | rsync | 3.5.0+ds1-0+deb13u1 | DEBIAN-CVE-2026-70457 |
| Debian:14 | rsync | 3.5.0+ds1-1 | DEBIAN-CVE-2026-70457 |
| Rocky Linux:10 | rsync | 0:3.5.0-3.el10_2 | RLSA-2026:67463 |
| Rocky Linux:9 | rsync | 0:3.2.7-1.el9_8 | RLSA-2026:67462 |
| Ubuntu:22.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70457 |
| Ubuntu:24.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70457 |
| Ubuntu:26.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70457 |
| Ubuntu:26.10 | rsync | no fix listed | UBUNTU-CVE-2026-70457 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RsyncProject | rsync | 3.2.3 – through 3.4.4 |
Weakness: CWE-131, CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- GitHub Security Advisory (GHSA-pg7g-xqmr-xpfh) vendor-advisory
- rsync 3.5.0 Release Notes release-notes
- https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg third-party-advisory