Integer overflow in rsync compressed-token decoder enables remote memory disclosure (CVE-2026-44508)

The rsync receiver's compressed-token decoder accumulates a 32-bit signed counter without checking for overflow. A malicious sender can trigger this overflow and, with careful manipulation, extract data stored in memory of the process, including environment variables, passwords, and memory pointers from the heap, stack, and libraries. The leakage of these pointers and data can significantly reduce the effectiveness of ASLR and facilitate further exploitation. Affected versions: - < 3.4.3 We recommend updating to: 3.4.3. CVSS 8.1 · our assessment: this_week Reference: https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq Details: https://vuln.today/cve/CVE-2026-44508