CVE-2026-43620

The record

Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.

Affected packages

Related vulnerabilities

• CVE-2026-29518 Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race… Also affects rsync
• CVE-2026-43618 Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… Also affects rsync
• CVE-2026-43619 Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in… Also affects rsync
• CVE-2026-43617 Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… Also affects rsync
• CVE-2026-45232 Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability… Also affects rsync
• CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a… Also affects rsync
• CVE-2025-10158 A malicious client acting as the receiver of an rsync file transfer can trigger an out of… Also affects rsync
• CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. Also affects rsync