CVE-2026-70461: 
rsync vulnerability analysis and mitigation

CVE-2026-70461 is a heap out-of-bounds write vulnerability in rsync's add_implied_include() function, allowing remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation. It affects rsync versions 3.2.5 through 3.4.4 (the function was introduced in 3.2.5) and is fixed in version 3.5.0. The vulnerability was discovered by Greg Kroah-Hartman via daemon-protocol fuzzing and disclosed on August 13, 2026. It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is an off-by-one buffer sizing error (CWE-787: Out-of-bounds Write) in the add_implied_include() function, which builds an implied /** filter rule from each transfer argument the client sends so the remote sender can validate the file list. When processing a files-from entry containing both an interior and a trailing backslash (e.g., a\b\), the function under-counts the trailing backslash when sizing the destination buffer, resulting in a one-byte write past the end of the heap allocation. An unauthenticated remote attacker can trigger this against a read-only rsync daemon module by sending -r --files-from= with a crafted entry via forward_filesfrom_data(); no write access or crafted protocol manipulation is required. The per-module parse_arguments() runs with am_server == 0, keeping trust_sender_args at 0 and leaving the implied-include path active (GitHub Advisory).

Successful exploitation causes heap corruption on the rsync daemon, which can result in a service crash (denial of service) or, under favorable heap layout conditions, potential code execution. The write is constrained to one attacker-controlled byte, so reliable code execution is not claimed by the reporter, but heap corruption is confirmed and detected as an ASan heap-buffer-overflow. The vulnerability is exploitable against read-only daemon modules, meaning even conservatively configured rsync servers are at risk. Confidentiality impact is assessed as none, while integrity and availability impacts are low and high, respectively (GitHub Advisory, Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment notes the vulnerability is automatable (no user interaction required) with partial technical impact. The EPSS score is approximately 0.51%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attribution is to Greg Kroah-Hartman, who discovered it through daemon-protocol fuzzing as part of malicious-peer robustness research (GitHub Advisory).

1. Reconnaissance: Identify internet-facing rsync daemon instances running versions 3.2.5 through 3.4.4 using tools like Shodan or Masscan, targeting the default rsync port (TCP 873).
2. Identify read-only modules: Connect to the rsync daemon and enumerate available modules (e.g., rsync rsync://target/) to identify read-only modules, which are sufficient to trigger the vulnerability.
3. Craft malicious files-from entry: Prepare a files-from input file containing an entry with both an interior and a trailing backslash, such as a\b\.
4. Send crafted request: Invoke rsync with -r --files-from=<crafted_file> targeting the vulnerable daemon module, causing forward_filesfrom_data() to pass the malformed entry to add_implied_include() on the daemon side.
5. Trigger heap corruption: The daemon's add_implied_include() under-counts the trailing backslash, writes one attacker-controlled byte past the end of the heap buffer, resulting in heap corruption, a potential crash, or (under specific heap layout conditions) further memory manipulation (GitHub Advisory).

• Network: Unexpected or repeated rsync connections (TCP 873) from unknown or external IP addresses to rsync daemon modules, particularly with --files-from arguments; connections to read-only modules from clients that would not normally access them.
• Logs: rsync daemon logs showing client connections supplying --files-from with entries containing backslash sequences (e.g., entries matching *\*\); daemon crash or unexpected termination entries in system logs (/var/log/syslog, /var/log/messages, or journald).
• Process: rsync daemon process (rsync --daemon) crashing or restarting unexpectedly; core dump files generated by the rsync daemon process in the working directory or /var/crash/.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the rsync daemon's working directory following unexpected termination.

Upgrade rsync to version 3.5.0 or later, which was released on August 13, 2026, as part of a major security release addressing this and other vulnerabilities (GitHub Release). Distribution-specific patches are available from SUSE (SUSE-SU-2026:3634-1, SUSE-SU-2026:3657-1), Fedora, and openSUSE. As a temporary workaround, restrict network access to rsync daemon modules using firewall rules or network-based filtering to limit exposure to trusted clients only. Disabling --files-from support at the daemon level or blocking untrusted client connections provides additional mitigation until patching is complete (GitHub Advisory, Microsoft MSRC).

The vulnerability was part of a broader set of security fixes in rsync 3.5.0, described by the project as a "major security release" focused on malicious-peer robustness (GitHub Release). Linux distributions including SUSE, openSUSE, and Fedora issued security advisories and updated packages promptly following disclosure. Coverage appeared on Linux security news aggregators such as LinuxSecurity.com and Pro-Linux.de, and Tenable published multiple Nessus detection plugins for the vulnerability. Community reaction was measured, reflecting the constrained nature of the one-byte write and the absence of a public exploit.