Skip to main content

rsync EUVDEUVD-2026-23215

| CVE-2026-41035 HIGH
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-04-16 mitre GHSA-m34r-4v3r-pp9v
Information Disclosure Samba Rsync
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Malicious data arrives from a remote peer (AV:N) but victim must run -X against an attacker-controlled host and only some configs are vulnerable (UI:R, AC:H); use-after-free yields full memory-corruption impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Red Hat
7.4 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

12
Analysis Updated
Jun 30, 2026 - 04:36 vuln.today
v6 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:36 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:35 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:34 vuln.today
v3 (cvss_changed)
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.4 (HIGH) 7.8 (HIGH)
Analysis Updated
Apr 22, 2026 - 04:28 vuln.today
v2 (cvss_changed)
Patch released
Apr 19, 2026 - 08:30 nvd
Patch available
Re-analysis Queued
Apr 16, 2026 - 21:22 vuln.today
cvss_changed
Analysis Generated
Apr 16, 2026 - 07:50 vuln.today
EUVD ID Assigned
Apr 16, 2026 - 07:30 euvd
EUVD-2026-23215
Analysis Generated
Apr 16, 2026 - 07:30 vuln.today
CVE Published
Apr 16, 2026 - 06:53 nvd
HIGH 7.4

DescriptionNVD

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

AnalysisAI

Receiver-side use-after-free in rsync 3.0.1 through 3.4.1 lets a malicious peer corrupt memory on a host running rsync with the -X (--xattrs) option. The receive_xattr function trusts an attacker-supplied length value during a qsort operation, which a malicious sender/server can abuse to crash the receiver or potentially achieve code execution; Linux hosts are vulnerable in many common configurations and non-Linux platforms more broadly. No public exploit identified at time of analysis, EPSS is very low (0.01%), and SSVC scores exploitation as none, indicating a real-but-not-urgent memory-safety bug rather than a mass-exploited threat.

Technical ContextAI

rsync is a widely used file-synchronization and transfer utility (the affected codebase is tracked under the CPE cpe:2.3:a:samba:rsync). The flaw is in receive_xattr, the routine that parses extended-attribute (xattr) metadata sent by the remote peer when extended-attribute preservation is requested via -X/--xattrs. The root cause maps to CWE-130 (Improper Handling of Length Parameter Inconsistency): the receiver relies on an untrusted length value supplied over the wire and uses it during a qsort call, producing a use-after-free condition on the receiving side. Extended attributes are a filesystem feature (e.g., security.*, user.*, system.* namespaces) whose handling differs across platforms, which is why exposure varies - only some Linux configurations exercise the vulnerable path while non-Linux platforms are more uniformly affected.

RemediationAI

Patch available per vendor advisory: upgrade rsync beyond 3.4.1 to the upstream fixed release (see https://github.com/RsyncProject/rsync/releases and issue https://github.com/RsyncProject/rsync/issues/871; an exact upstream tag is not independently confirmed from the provided data). Distribution users should apply their packaged fixes - Ubuntu USN-8283-1 (https://ubuntu.com/security/notices/USN-8283-1) and Red Hat errata RHSA-2026:17481/19152/19368/20601-20604 (https://access.redhat.com/errata/). Where immediate patching is not possible, the most effective compensating control is to avoid the -X/--xattrs option on the receiving side, since the bug is only reachable when extended-attribute transfer is enabled - the trade-off is that extended attributes (SELinux labels, ACprobably-related metadata, user.* attributes) will no longer be synchronized. Additionally, only synchronize with trusted peers/servers and restrict rsync transfers to authenticated, trusted endpoints (e.g., over SSH with known hosts), since the malicious data originates from the remote peer; the trade-off is reduced flexibility for ad-hoc transfers.

More in Samba

View all
CVE-2017-7494 CRITICAL POC
9.8 May 30

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
CVE-2012-1182 CRITICAL POC
10.0 Apr 10

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement valida
CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1
CVE-2016-2118 HIGH POC
7.5 Apr 12

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x befor
CVE-2013-4124 MEDIUM POC
5.0 Aug 06

Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.
CVE-2014-3560 HIGH
7.9 Aug 06

NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to exec
CVE-2012-0870 HIGH
7.9 Feb 23

Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry Play
CVE-2015-7540 HIGH
7.5 Dec 29

The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful
CVE-2017-15275 HIGH
7.5 Nov 27

Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to c
CVE-2017-14746 CRITICAL
9.8 Nov 27

Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted S
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
CVE-2015-5252 HIGH POC
7.2 Dec 29

vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with cert

Same weakness CWE-130 – Improper Handling of Length Parameter Inconsistency

View all
CVE-2022-1543 HIGH POC
8.8
CVE-2022-3290 HIGH POC
7.5
CVE-2022-3272 HIGH POC
7.5
CVE-2021-36090 HIGH
7.5
CVE-2022-2714 CRITICAL
9.8
CVE-2021-20588 CRITICAL
9.8
CVE-2021-35517 HIGH
7.5
CVE-2026-67292 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Share

EUVD-2026-23215 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy