CVE-2026-43619 is a high-severity vulnerability affecting rsync versions up to 3.4.2. It is a TOCTOU race condition involving symlink handling in path-based system calls such as chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat. Local attackers with filesystem access can exploit the timing window between path resolution and syscall execution to redirect operations outside the exported rsync module, potentially modifying arbitrary files when the rsync daemon is configured without chroot isolation ('use chroot = no'). The CVSS 4.0 score is 7.2, reflecting high impact with local attack vector, high complexity, and partial privileges required.

Successful exploitation allows a local attacker to modify files outside the intended rsync module boundary by redirecting file operations through symlink swapping. This can lead to unauthorized changes in file permissions, ownership, timestamps, or filenames on the target system. The vulnerability affects rsync daemons configured without chroot isolation, increasing the risk of unauthorized file system modifications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to configure rsync daemons with 'use chroot = yes' to isolate the file system and mitigate the risk of this race condition. Avoid running rsync daemons with elevated privileges and restrict local filesystem access to trusted users only.