CVE-2026-78002: Incorrect Calculation of Buffer Size in Red Hat Red Hat Enterprise Linux 10

This vulnerability arises from an incorrect buffer size calculation during string replacement in the RainerScript replace() function of rsyslog. When processing specially crafted syslog messages, this flaw triggers a heap buffer overflow leading to memory corruption. The flaw allows an unauthenticated remote attacker to cause a denial of service on Red Hat Enterprise Linux 10 systems configured to receive remote syslog messages. The vulnerability impacts logging availability by potentially crashing or restarting the rsyslog service.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by triggering a heap buffer overflow in rsyslog's RainerScript replace() function. This results in memory corruption that can crash or restart the affected system, impacting system availability and logging functionality. There is no impact on confidentiality or integrity according to the vendor advisory.

Red Hat recommends restricting network access to the rsyslog service to trusted hosts by configuring firewall rules to limit incoming connections on UDP and TCP port 514. Alternatively, if remote syslog reception is not required, disable the imudp and imtcp modules in /etc/rsyslog.conf. After applying these changes, restart the rsyslog or firewall service. No official patch or update is explicitly stated in the advisory; thus, these configuration changes are the primary mitigations.