CVE-2026-44508 describes an integer overflow (CWE-190) in RsyncProject's rsync tool in versions before 3.4.3. The receiver's compressed-token decoder uses a 32-bit signed counter that does not check for overflow. A malicious sender can exploit this to cause an overflow, leading to memory data leakage (CWE-200) including environment variables, passwords, and pointers from heap, stack, and libraries. This leakage reduces the effectiveness of ASLR, aiding further attacks. The issue is resolved in rsync version 3.4.3.

Successful exploitation can lead to disclosure of sensitive memory contents such as environment variables and passwords, and memory pointers that undermine ASLR protections. This can facilitate further exploitation of the affected system. The vulnerability has a CVSS 3.1 score of 8.1 (high severity), indicating a network attack vector with low complexity and no user interaction required, but requiring low privileges.

Upgrade rsync to version 3.4.3 or later to apply the official fix for this vulnerability. No other mitigations are indicated or substitute for applying the patch.