CVE-2026-70456: rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-10-24
Weakness: CWE-787

Description

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.

Affected products

RsyncProject rsync: from 3.0.1 through 3.4.4

References

https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw
https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args

Get alerted when CVE-2026-70456 or the next vulnerability affects your stack