CVE-2026-70457
highpriority · track · 33EPSS 0.004 · 32 %ileDEEUUSEPSS · scored 2026-10-27
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.8–8.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (15)
Products and version ranges known to be affected.
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2817Rsync: Mehrere SchwachstellenDeutsch2026-08-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/RsyncProject/rsync/releasesPatchcnnvd
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0cnnvd
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfhcnnvd
- https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-argcnnvd
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0enisa_euvd
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfhenisa_euvd
- https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-argenisa_euvd
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0ProductRelease Notesnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan