Skip to main content

rsync EUVDEUVD-2026-46106

| CVE-2026-44508 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-07-20 GitHub_M
Information Disclosure Integer Overflow Rsync Suse
8.1
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Network-reachable low-complexity attack by a malicious sending peer (PR:L); primary impact is memory disclosure so C:H, I:N, and only incidental crash risk gives A:L rather than the source's A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch available
Jul 20, 2026 - 23:18 EUVD
Analysis Generated
Jul 20, 2026 - 21:32 vuln.today
CVE Published
Jul 20, 2026 - 20:30 cve.org
HIGH 8.1

DescriptionCVE.org

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver's compressed-token decoder accumulated a 32-bit signed counter without checking for overflow. A malicious sender can trigger an overflow that with careful manipulation can lead to the extraction of data stored in memory of the process allowing an attacker to access environment variables, passwords and memory pointers from the heap, stack, and libraries. The leakage of these pointers and data can significantly reduce the effectiveness of ASLR and facilitate further exploitation. This issue is fixed in version 3.4.3.

AnalysisAI

Heap and stack memory disclosure in rsync versions prior to 3.4.3 lets a malicious sender leak process memory from a receiver by overflowing an unchecked 32-bit signed counter in the compressed-token decoder. The leaked contents can include environment variables, passwords, and heap/stack/library pointers, undermining ASLR and enabling follow-on exploitation. No public exploit is identified at time of analysis, there is no CISA KEV listing, and EPSS was not provided, so real-world exploitation should be treated as unproven but plausible.

Technical ContextAI

rsync implements a delta-transfer protocol in which a sender streams compressed tokens describing which existing blocks to reuse and which literal data to insert. On the receiving side the token decoder accumulates a running length/position value in a 32-bit signed integer without validating it against buffer bounds (CWE-190, Integer Overflow or Wraparound). When the counter wraps past INT_MAX it becomes negative or otherwise inconsistent, causing the receiver to read outside the intended reconstruction buffer and emit adjacent process memory into the file it is assembling. Because the vulnerable role is the receiver, any deployment where rsync accepts a data stream from an untrusted peer (client pulling from a hostile server, or a daemon receiving pushed data) is in scope. The single affected CPE is cpe:2.3:a:rsyncproject:rsync:*:*:*:*:*:*:*:*, i.e. the upstream rsync package across all versions below 3.4.3.

RemediationAI

Vendor-released patch: rsync 3.4.3 - upgrade all rsync binaries acting as receivers (and, for consistency, senders) to 3.4.3 or later, referencing https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq, and rebuild or update any distro/appliance packages that bundle rsync. Where immediate patching is not possible, reduce exposure by only syncing from and to trusted, authenticated peers: restrict rsync daemon access with 'hosts allow'/'hosts deny' and firewall rules limiting TCP/873 (and any SSH-tunneled rsync) to known hosts, and avoid pulling from untrusted rsync servers, since the receiver is the vulnerable party. As a stronger control you can disable transfer compression on the wire (run with --compress-level=0 or omit -z, and set 'dont compress' server-side) to reduce reliance on the compressed-token path - trade-off: higher bandwidth use and it may not fully eliminate the code path, so treat it as risk reduction, not a fix. Running rsync daemons as an unprivileged, chrooted user limits the sensitivity of memory that can be disclosed but does not stop the leak.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa
CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i
CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d
CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv
CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati
CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character
CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_
CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by
CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli
CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

EUVD-2026-46106 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy