rsyslog CVE-2026-61548

Four specific conditions must all be simultaneously present for exploitation: (1) the mmpstrucdata plugin binary must be installed on the system - packaging varies by distribution and the module is not always included; (2) the plugin must be explicitly loaded and used in the active rsyslog configuration via a load directive and an action referencing the module - it is not active by default; (3) attacker-controlled RFC 5424 structured-data content must reach the rsyslog input path processed by that mmpstrucdata action, meaning the attacker must be able to send syslog messages to the rsyslog listener; and (4) the effective MaxMessageSize setting must be configured above the upstream default to a value that permits a single structured-data parameter value exceeding 32,768 bytes - the reporter used global(maxMessageSize='40000') to reproduce the crash. Default rsyslog deployments that do not load mmpstrucdata, or that retain the default MaxMessageSize, are not affected. Exploitation is limited to network-reachable rsyslog inputs; there is no browser, web application, or end-user interaction vector.

The vendor-assigned CVSS 3.1 score is 8.1 (High), consistent with a network-reachable unauthenticated overflow requiring non-default configuration (AC:H). Real-world risk is meaningfully lower than a raw 8.1 suggests because exploitation requires a conjunction of non-default conditions: the mmpstrucdata plugin must be installed, explicitly loaded, and actively used in the configuration, and MaxMessageSize must have been raised above the upstream default to exceed the 32 KiB threshold. Deployments relying on default configurations are not affected. No EPSS score was provided in the source data, and the vulnerability has not been added to the CISA KEV catalog, indicating no confirmed mass exploitation. The demonstrated impact is a reliable process crash (DoS); code execution remains theoretical - the rsyslog project explicitly states it has not demonstrated RCE on standard hardened glibc-based distribution builds. The gap between the CVSS score (which accounts for worst-case RCE potential) and the confirmed impact (process crash) is significant and should inform triage priority. Deployments using mmpstrucdata with elevated MaxMessageSize should treat this as high priority; all others can treat it as lower urgency.

An attacker with network access to an rsyslog listener (TCP or UDP) on a host where mmpstrucdata is loaded and MaxMessageSize has been raised above the default constructs a valid RFC 5424 syslog message containing a structured-data parameter value longer than 32,768 bytes and transmits it to the listener. rsyslog routes the message through the mmpstrucdata action, parsePARAM_VALUE() writes past the end of the fixed stack buffer, and the rsyslog process crashes, interrupting all log collection on that host. No exploit code has been publicly released, but the crash was confirmed by the reporter on Debian 12 over both TCP and UDP.