High severity · published Aug 13, 2026
CVE-2026-70456
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
rsync · RsyncProject
3.0.1 through 3.4.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-70456
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-70456
github.com
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
github.com
https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw
www.vulncheck.com
https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args
More from rsync
9.1
CVE-2026-53791
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
8.2
CVE-2026-70457
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
8.2
CVE-2026-70458
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
8.2
CVE-2026-70461
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
8.1
CVE-2026-70460
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink