CVE-2026-70458

A flaw was found in rsync. This out-of-bounds write vulnerability allows attackers to corrupt memory by triggering specific processing on specially crafted file entries when hard-link preservation is not active. This can lead to denial of service or other unpredictable system behavior.

This Important out-of-bounds write vulnerability in rsync can lead to memory corruption when processing specially crafted file entries, potentially resulting in a denial of service. The flaw is triggered when hard-link preservation is inactive, allowing a remote attacker to exploit it without requiring user interaction or elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the rsyncd daemon if unused (systemctl disable --now rsyncd), or strictly limit TCP/873 access to trusted clients via firewall rules. For daemons that must remain active, explicitly set refuse options = checksum in rsyncd.conf to block the demonstrated out-of-bounds write vector. Finally, when operating as a client pulling from untrusted peers, always append the --hard-links (-H) flag to force safe memory allocation and prevent corruption.