CVE-2026-44508 Details

An integer overflow vulnerability has been identified in Rsync versions prior to 3.4.3. The issue arises in the receiver's compressed-token decoder, which improperly accumulates a 32-bit signed counter without validating for overflow. This flaw enables a malicious sender to trigger an overflow that, with careful manipulation, can lead to the extraction of sensitive data from the process's memory. An attacker could access environment variables, passwords, and memory pointers from the heap, stack, and libraries. The leakage of these pointers and data could significantly undermine the effectiveness of Address Space Layout Randomization (ASLR), facilitating further exploitation.

Users can upgrade to Rsync version 3.4.3 or later to address this vulnerability. Alternatively, compression can be disabled on the affected daemon by setting 'refuse options = compress' in the rsyncd.conf file.