CVE-2026-70457

Name of the Vulnerable Software and Affected Versions rsync versions 3.2.3 through 3.4.x

Description An out-of-bounds write exists in the parse size arg() function. The issue occurs because the return value of snprintf() is used as an index for a .bss-segment array without proper bounds checking. When snprintf() truncates a formatted size string, it returns the number of characters that would have been written, which can exceed the array length. This leads to a write operation targeting memory outside the intended bounds, resulting in the corruption of .bss memory (a segment of memory used for uninitialized global and static variables).

Recommendations Update rsync to version 3.5.0. As a temporary workaround, restrict the use of the parse size arg() function to minimize the risk of exploitation.