CVE-2026-70458 is an out-of-bounds write vulnerability in rsync versions 3.0.0 up to and including 3.4.4. The vulnerability is triggered by HLINK_BUMP processing on file entries marked with the FLAG_HLINKED flag while the hard-link preservation option is disabled. Due to the absence of the F_SUM field in the file_struct layout, the code accesses memory beyond the allocated structure, potentially corrupting adjacent heap or stack data. This memory corruption could lead to undefined behavior or crashes. The vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity. There is no known exploit in the wild and no vendor advisory or patch has been published as of the data provided.

Successful exploitation can cause memory corruption by writing out-of-bounds during file processing in rsync. This may lead to application crashes or potentially allow attackers to manipulate adjacent memory, which could affect program stability or security. The vulnerability affects unauthenticated remote attackers over the network with no user interaction required. The high CVSS score reflects the potential for significant impact, but no active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding use of affected rsync versions in untrusted environments or restrict access to trusted users only. Monitor official RsyncProject channels and Ubuntu security advisories for updates and patches.