PT-2026-71661
CVE-2026-70461
·
Published
2026-08-13
·
Updated
2026-10-21
Description by
CVSS 4.0
8.8
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
rsync versions 3.2.5 through 3.4.x
Description
A heap out-of-bounds write allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation. This occurs when a crafted files-from entry containing both an interior and trailing backslash is supplied to a read-only rsync daemon module, causing the
add implied include() function to under-count the trailing backslash during destination buffer sizing.Recommendations
Update to version 3.5.0.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾