CVE-2026-44510 Details

A receiver-side out-of-bounds array read vulnerability has been identified in Rsync versions prior to 3.4.3. This issue allows a malicious Rsync server, or any peer in the sender role, to crash an Rsync client that is pulling files from it. The vulnerability arises in the 'recv_files()' function, where the receiver can be tricked into reading memory outside of allocated bounds. This is achieved by sending a crafted file list that exploits the way Rsync handles directory entries, leading to a crash when the client dereferences the invalid memory. The problem is triggered at the wire protocol level, requiring no special options on the client side, and affects both 'rsync://' URLs and remote-shell pulls. The impact is a crash of the Rsync client, as the out-of-bounds read interferes with memory management, causing a segmentation fault. However, this crash cannot be exploited further on glibc x86-64 Linux systems, as the faulted memory address is unmapped and inaccessible, confirmed not to be an issue on non-glibc allocators.

Users can upgrade to Rsync version 3.4.3 or later, where this vulnerability has been patched. Alternatively, Rsync clients can disable the 'inc_recursive' option when pulling files, although this may impact performance on large transfers.