CVE-2026-43618 is an integer overflow vulnerability in RsyncProject's rsync utility (versions up to 3.4.2) within the compressed-token decoder component. The vulnerability arises because a 32-bit signed counter is not properly checked for overflow, enabling a malicious sender to trigger an overflow condition. This overflow causes the receiver to read and return data from outside the intended buffer boundaries, potentially leaking sensitive process memory including environment variables, passwords, heap and stack data, and library memory pointers. This memory disclosure significantly reduces the effectiveness of Address Space Layout Randomization (ASLR), facilitating further exploitation. Red Hat advisories confirm the issue and provide security updates rebasing rsync to version 3.4.4 to fix the vulnerability.

Successful exploitation can lead to remote disclosure of process memory on the rsync receiver side, exposing sensitive information such as environment variables, passwords, and memory pointers. This undermines ASLR protections and may aid attackers in conducting further attacks. The CVSS 4.0 base score is 6.1 (medium severity), reflecting the network attack vector, low attack complexity, partial privileges required, and high impact on confidentiality and availability.

Red Hat has issued security updates rebasing rsync to version 3.4.4 that fix this integer overflow vulnerability. Users of affected Red Hat Enterprise Linux versions should apply these official patches promptly. Since this is not a cloud service, remediation depends on applying vendor-provided updates. Patch status is confirmed by Red Hat advisories. No vendor advisory states that no action is required or that the issue is already mitigated without patching.