CVE-2026-43618 is an integer overflow vulnerability in RsyncProject's rsync utility (version 3.4.2 and prior) within the compressed-token decoder. The vulnerability arises because a 32-bit signed counter is not checked for overflow, allowing an attacker controlling the sender to trigger an overflow. This overflow causes the receiver process to read and return data from outside the intended buffer bounds, leading to remote disclosure of process memory including environment variables, passwords, heap and stack data, and library memory pointers. This memory disclosure significantly reduces the effectiveness of Address Space Layout Randomization (ASLR), increasing the risk of further exploitation. Red Hat advisories confirm the issue and provide updates rebasing rsync to version 3.4.4 in Red Hat Enterprise Linux 10 to fix this vulnerability.

An attacker who can send data to a vulnerable rsync receiver can exploit this integer overflow to read sensitive memory contents remotely. This includes environment variables, passwords, heap and stack data, and pointers to libraries. The disclosure of such information undermines ASLR protections and can facilitate subsequent attacks. The vulnerability is rated with a CVSS 4.0 base score of 6.1 (medium severity) and requires low privileges to exploit, with partial attack complexity and partial user interaction.

Red Hat has issued security advisories and updates that rebase rsync to version 3.4.4, which includes a fix for this integer overflow vulnerability. Users of affected Red Hat Enterprise Linux 10 versions should apply the provided updates promptly. Since this is not a cloud service, remediation depends on applying the vendor-supplied patches. Patch status is confirmed by Red Hat advisories linked in the references. No alternative mitigations are indicated in the vendor advisory.