CVE-2026-43619

The record

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.

Affected packages

Related vulnerabilities

• CVE-2026-29518 Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race… Also affects rsync
• CVE-2026-43620 Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read… Also affects rsync
• CVE-2026-43618 Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… Also affects rsync
• CVE-2026-43617 Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… Also affects rsync
• CVE-2026-45232 Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability… Also affects rsync
• CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a… Also affects rsync
• CVE-2025-10158 A malicious client acting as the receiver of an rsync file transfer can trigger an out of… Also affects rsync
• CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. Also affects rsync