rclone CVE-2026-79775

Exploitation requires three concrete conditions. First, the target rclone deployment must be configured with an :archive: remote (introduced in v1.72.0 and present through v1.74.4) - installations that do not use this backend type are not vulnerable regardless of rclone version. Second, the attacker must have write or modify access to the storage underlying that :archive: remote in order to place or alter a SquashFS image file - read-only access to the storage is insufficient to trigger any variant. Third, a victim process or authenticated client must actively address or descend into the malicious archive object (e.g., list its contents, access a path within it); the parser is lazy and does not evaluate images on ingest. Exploitation is limited by the write-access prerequisite and the lazy-parsing trigger requirement. In the 'rclone serve sftp' variant, the attacker can collapse conditions 2 and 3 by being an SFTP client with write privileges, triggering the crash themselves.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) scores 7.1 and accurately reflects the attack surface: network-reachable, low complexity, requiring only low-level write privileges to the storage backend, with high availability impact. The critical deployment amplifier is 'rclone serve sftp': a single malicious SquashFS image traversal crashes the entire SFTP server, multiplying impact beyond a single rclone invocation. Variants 1 and 2 are deterministic process-terminators; variant 3 is a sustained resource exhaustion. EPSS data is not available in the provided intelligence, and the vulnerability is not in CISA KEV. No public exploit code has been identified. Real-world risk is bounded by the prerequisite of write access to the storage exposed via rclone's :archive: remote - environments where untrusted parties can write to such storage face genuine operational risk, while read-only or tightly access-controlled backends significantly reduce exposure.

An attacker with write access to a cloud storage bucket or file share exposed through an rclone :archive: remote uploads a crafted SquashFS image containing a superblock with a zero block size field. When a legitimate user or automated rclone job descends into that archive directory listing, the parser reads the unvalidated block size and performs an integer division, triggering a Go runtime panic that terminates the rclone process. In the 'rclone serve sftp' deployment model, this same action - performed by the attacker themselves as an authenticated SFTP client - crashes the server for all connected users simultaneously.