rsyslog CVE-2026-78002

rsyslog must be configured to accept syslog messages from the network via a network input module (such as imudp or imtcp) bound to a network-reachable interface. Additionally, the rsyslog RainerScript configuration must include rules that invoke the replace() function on fields derived from incoming log messages - systems where this function is not used in active ruleset processing may not trigger the vulnerable code path. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity are required from the attacker side. Exploitation is limited to systems actively receiving remote syslog traffic with the replace() function in their RainerScript rules; rsyslog instances processing only local (Unix socket) log sources are not directly exposed via the network vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-exploitable, unauthenticated, zero-interaction flaw with low attack complexity - meaning the overflow trigger is expected to be highly reliable once an attacker identifies the right message payload. The impact is strictly an availability loss: no confidentiality or integrity compromise is possible based on available data. This limits the worst-case outcome to a process crash, but disrupting rsyslog is operationally significant because it is the primary log collection daemon on RHEL systems; crashing it blinds SIEM pipelines and audit trails, creating a secondary risk window. No CISA KEV listing exists and no public exploit code has been identified, so this is not confirmed as actively exploited. EPSS data was not provided in the input, so exploitation probability cannot be quantified. Despite the DoS-only scope, the broad RHEL deployment footprint and low exploitation complexity make this a patch-priority item for any environment relying on centralized syslog collection - the combination of no authentication required and low attack complexity means exploitation is accessible to unsophisticated attackers once details are public.

An attacker with network access to a host running rsyslog with a network input module (imudp or imtcp) enabled sends a specially crafted syslog message designed to invoke the RainerScript replace() function with input that triggers the undersized buffer calculation. The resulting heap overflow corrupts memory and crashes the rsyslog process, halting log collection on the target system. No public exploit code has been identified at time of analysis, though the low attack complexity suggests a reliable trigger is achievable through fuzzing or inspection of the buffer size logic.