Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
References
| Link | Resource |
|---|---|
| https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 | Release Notes |
| https://github.com/RsyncProject/rsync/security/advisories/GHSA-28pw-r563-rxvm | Vendor Advisory |
| https://www.vulncheck.com/advisories/rsync-out-of-bounds-array-read-via-recv-files | Third Party Advisory |
Configurations
History
21 May 2026, 20:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* | |
| References | () https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 - Release Notes | |
| References | () https://github.com/RsyncProject/rsync/security/advisories/GHSA-28pw-r563-rxvm - Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/rsync-out-of-bounds-array-read-via-recv-files - Third Party Advisory | |
| First Time |
Samba
Samba rsync |
20 May 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-20 02:16
Updated : 2026-05-21 20:47
NVD link : CVE-2026-43620
Mitre link : CVE-2026-43620
CVE.ORG link : CVE-2026-43620
JSON object : View
Products Affected
samba
- rsync
CWE
CWE-125
Out-of-bounds Read