CVE-2026-29518

The record

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

Affected packages

Related vulnerabilities

• CVE-2026-43620 Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read… Also affects rsync
• CVE-2026-43618 Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… Also affects rsync
• CVE-2026-43619 Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in… Also affects rsync
• CVE-2026-43617 Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… Also affects rsync
• CVE-2026-45232 Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability… Also affects rsync
• CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a… Also affects rsync
• CVE-2025-10158 A malicious client acting as the receiver of an rsync file transfer can trigger an out of… Also affects rsync
• CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. Also affects rsync