CVE-2026-70458 rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
Attackers can trigger an out-of-bounds write in rsync via hard-link handling, potentially leading to memory corruption and code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70458?
CVE-2026-70458 is a high-severity memory corruption vulnerability in RsyncProject rsync, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.
Weakness: CWE-787
Which versions are affected by CVE-2026-70458?
How do I fix CVE-2026-70458?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-70458 being exploited?
There is no known exploitation of CVE-2026-70458 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-70458, AZL-95759, BELL-CVE-2026-70458, DEBIAN-CVE-2026-70458, ECHO-7d81-cb43-3188, GHSA-gg3m-4m9m-268h and 2 more.