CVE-2026-70461 is a heap out-of-bounds write vulnerability in RsyncProject's rsync software versions 3.2.5 through 3.4.4. The vulnerability arises when a remote unauthenticated attacker provides a crafted files-from entry containing both an interior and trailing backslash to a read-only rsync daemon module. The add_implied_include() function miscalculates the required buffer size by under-counting the trailing backslash, allowing the attacker to write one byte beyond the allocated heap buffer. This memory corruption could potentially lead to denial of service or other impacts depending on the context of use. The CVSS 4.0 score is 8.8, indicating high severity. No vendor advisory or patch information is currently available.

This vulnerability allows remote unauthenticated attackers to perform a heap out-of-bounds write by sending a crafted files-from entry to a read-only rsync daemon module. The out-of-bounds write is limited to one byte past the allocated buffer, which can cause memory corruption. The impact may include denial of service or other undefined behavior depending on the environment. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to rsync daemon modules and monitoring for suspicious files-from entries containing backslashes. No official patch or workaround has been published at this time.