CVE-2026-70457

An out-of-bounds write vulnerability in rsync's parse_size_arg() function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf() truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and potentially compromise data integrity.

This Moderate impact flaw in rsync stems from an out-of-bounds write in the parse_size_arg() function. Although no privileges or user interaction are required, the high attack complexity indicates that exploitation is not straightforward. Successful exploitation could lead to memory corruption, potentially causing a denial of service or compromising data integrity on affected Red Hat systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If rsync is configured to run as a daemon, restrict network access to trusted hosts using firewall rules. For example, to limit access to localhost: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="873" protocol="tcp" source address="127.0.0.1" accept' firewall-cmd --reload This may impact legitimate remote rsync operations. If rsync is not used as a daemon, ensure that only trusted sources are used for rsync operations.