CVE-2026-43618 Rsync < 3.4.3 Integer Overflow Information Disclosure
A malicious sender can trigger an integer overflow in rsync to disclose process memory, aiding ASLR bypass and further exploitation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43618?
CVE-2026-43618 is a medium-severity vulnerability in RsyncProject rsync, published on 20 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.
Which versions are affected by CVE-2026-43618?
It affects 1 product.
Products include Samba Rsync.
How do I fix CVE-2026-43618?
Upgrade to a fixed version.
Is CVE-2026-43618 being exploited?
There is no known exploitation of CVE-2026-43618 in the wild and no public exploit code.
Other vulnerabilities in RsyncProject rsync
- CVE-2017-15994 Security feature bypass in n/a
- CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
- CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
- CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
- CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
Sources
Also known as ALPINE-CVE-2026-43618, AZL-86988, BELL-CVE-2026-43618, CLSA-2026-1779368965, CLSA-2026-1779369352, CLSA-2026-1779369622 and 15 more.