Executive brief
Rsync is a widely used tool for synchronizing and copying files between different systems. A security flaw in how it handles compressed data allows a malicious user to extract sensitive information from the system's memory, including passwords and environment variables. This could lead to a significant data breach or help an attacker bypass other security protections to gain deeper access to the server.
Technical details
An integer overflow vulnerability (CWE-190) exists in the rsync receiver's compressed-token decoder. The component fails to check for overflow when accumulating a 32-bit signed counter. A malicious sender can exploit this by sending specially crafted compressed data to trigger the overflow, leading to an out-of-bounds read. This allows the extraction of sensitive data from the process memory, including environment variables, passwords, and stack/heap pointers. The leakage of these pointers can be used to bypass Address Space Layout Randomization (ASLR), facilitating further exploitation. The issue is fixed in version 3.4.3; a workaround involves disabling compression in rsyncd.conf.
Affected products
- RsyncProject rsync < 3.4.3
Timeline
- 2026-05-20: advisory: Initial GitHub advisory published
- 2026-07-20: disclosed: NVD publication date