CVE-2026-44510

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3

Description A receiver-side out-of-bounds array read exists in the recv files() function. This allows a malicious rsync server or any peer acting as a sender to cause a deterministic crash of an rsync client during a file pull. The issue is triggered at the wire-protocol level and affects both rsync:// URLs and remote-shell pulls, specifically when performing a normal recursive pull. An attacker can trigger this by setting CF INC RECURSE, sending a flist where the first sorted entry is not the leading "." directory (setting parent ndx to -1), and then sending a transfer record with ndx = 0 and an iflag that omits ITEM TRANSFER. This sequence forces the receiver to read 8 bytes before the allocated pointer array and dereference the result in f name(). On glibc x86-64 Linux, this results in a segmentation fault (SEGV) due to dereferencing an unmapped low address, leading to a crash.

Recommendations Update to version 3.4.3.