CVE-2026-43618
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to…
Does this matter?
Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own.
Description
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.
- CVSS 4.0
- 6.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125, CWE-190
- Affected
- samba/rsync
- Source
- disclosure@vulncheck.com
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.4.3Release Notes
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwqVendor Advisory
- https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosureThird Party Advisory
- https://access.redhat.com/errata/RHSA-2026:26332
- https://access.redhat.com/errata/RHSA-2026:26408
- https://access.redhat.com/errata/RHSA-2026:26410
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/security/cve/CVE-2026-43618
- https://bugzilla.redhat.com/show_bug.cgi?id=2469054
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.