CVE-2026-43620: Out-of-bounds Read in RsyncProject rsync
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
AI Analysis
Technical Summary
CVE-2026-43620 is an out-of-bounds array read vulnerability in rsync versions 3.4.2 and prior, specifically in the recv_files() function of receiver.c. The issue arises when a malicious rsync server sets the CF_INC_RECURSE compatibility flag and sends a crafted file list where the first sorted entry is not the leading dot directory. This is followed by a transfer record with ndx=0 and an iflag word lacking ITEM_TRANSFER. This sequence causes the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client process.
Potential Impact
Successful exploitation causes a denial of service by crashing the rsync client process. There is no indication of code execution or data corruption beyond the client crash. The vulnerability requires no privileges and no user interaction, but the client must connect to a malicious rsync server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting rsync clients to untrusted or malicious servers to prevent exploitation of this vulnerability.
CVE-2026-43620: Out-of-bounds Read in RsyncProject rsync
Description
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/rsyncproject/rsyncRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-43620 is an out-of-bounds array read vulnerability in rsync versions 3.4.2 and prior, specifically in the recv_files() function of receiver.c. The issue arises when a malicious rsync server sets the CF_INC_RECURSE compatibility flag and sends a crafted file list where the first sorted entry is not the leading dot directory. This is followed by a transfer record with ndx=0 and an iflag word lacking ITEM_TRANSFER. This sequence causes the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client process.
Potential Impact
Successful exploitation causes a denial of service by crashing the rsync client process. There is no indication of code execution or data corruption beyond the client crash. The vulnerability requires no privileges and no user interaction, but the client must connect to a malicious rsync server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting rsync clients to untrusted or malicious servers to prevent exploitation of this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-01T18:22:45.639Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0d0f6cba1db473621796e4
Added to database: 05/20/2026, 01:33:32 UTC
Last enriched: 07/15/2026, 10:32:29 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 208
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.