Vulnerability · Published May 20, 2026 · Assigned by VulnCheck
CVE-2026-43618Rsync < 3.4.3 Integer Overflow Information Disclosure
High 8.1
In plain English
A high-severity integer overflow in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rsync | 3.4.4-1.el10_2 | ALSA-2026:26332 |
| AlmaLinux:8 | rsync | 3.1.3-27.el8_10 | ALSA-2026:26408 |
| AlmaLinux:9 | rsync | 3.2.5-7.el9_8.2 | ALSA-2026:26410 |
| AlmaLinux:10 | rsync-daemon | 3.4.4-1.el10_2 | ALSA-2026:26332 |
| AlmaLinux:8 | rsync-daemon | 3.1.3-27.el8_10 | ALSA-2026:26408 |
| AlmaLinux:9 | rsync-daemon | 3.2.5-7.el9_8.2 | ALSA-2026:26410 |
| AlmaLinux:10 | rsync-rrsync | 3.4.4-1.el10_2 | ALSA-2026:26332 |
| AlmaLinux:9 | rsync-rrsync | 3.2.5-7.el9_8.2 | ALSA-2026:26410 |
| Alpine:v3.20 | rsync | 3.4.3-r0 | ALPINE-CVE-2026-43618 |
| Alpine:v3.21 | rsync | 3.4.3-r0 | ALPINE-CVE-2026-43618 |
| Alpine:v3.22 | rsync | 3.4.3-r0 | ALPINE-CVE-2026-43618 |
| Alpine:v3.23 | rsync | 3.4.3-r0 | ALPINE-CVE-2026-43618 |
| Alpine:v3.24 | rsync | 3.4.3-r0 | ALPINE-CVE-2026-43618 |
| Debian:12 | rsync | 3.2.7-1+deb12u5 | DEBIAN-CVE-2026-43618 |
| Debian:13 | rsync | 3.4.1+ds1-5+deb13u3 | DEBIAN-CVE-2026-43618 |
| Debian:14 | rsync | 3.4.3+ds1-1 | DEBIAN-CVE-2026-43618 |
| Rocky Linux:10 | rsync | 0:3.4.4-1.el10_2 | RLSA-2026:26332 |
| Rocky Linux:8 | rsync | 0:3.1.3-27.el8_10 | RLSA-2026:26408 |
| Rocky Linux:9 | rsync | 0:3.2.5-7.el9_8.2 | RLSA-2026:26410 |
| Ubuntu:22.04:LTS | rsync | 3.2.7-0ubuntu0.22.04.6 | UBUNTU-CVE-2026-43618 |
| Ubuntu:24.04:LTS | rsync | 3.2.7-1ubuntu1.4 | UBUNTU-CVE-2026-43618 |
| Ubuntu:25.10 | rsync | 3.4.1+ds1-5ubuntu1.2 | UBUNTU-CVE-2026-43618 |
| Ubuntu:26.04:LTS | rsync | 3.4.1+ds1-7ubuntu0.2 | UBUNTU-CVE-2026-43618 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RsyncProject | rsync | 0 – before 3.4.3 |
Weakness: CWE-190, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
References
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq vendor-advisory
- https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 release-notes
- https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosure third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-43618 vdb-entry, x_refsource_REDHAT
- RHBZ#2469054 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:26332 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26410 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26408 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29197 vendor-advisory, x_refsource_REDHAT