{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-70457","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-13T15:19:59.490","lastModified":"2026-10-24T16:10:00.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory."},{"lang":"es","value":"rsync 3.2.3 anterior a 3.5.0 contiene una escritura fuera de límites en parse_size_arg() donde el valor de retorno de snprintf() se utiliza directamente como un índice en un array del segmento .bss sin comprobación de límites. Cuando snprintf trunca la cadena de tamaño formateada, el valor de retorno es igual al número de caracteres que se habrían escrito incluyendo la porción truncada, y este valor puede exceder la longitud del array. La escritura indexada subsiguiente apunta a memoria fuera de los límites previstos del array, corrompiendo la memoria .bss."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"RsyncProject","product":"rsync","defaultStatus":"unaffected","repo":"https://github.com/RsyncProject/rsync","packageURL":"pkg:github/RsyncProject/rsync","versions":[{"version":"3.2.3","lessThanOrEqual":"3.4.4","versionType":"semver","status":"affected"},{"version":"3.5.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T17:32:36.324059Z","id":"CVE-2026-70457","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-131"},{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.3","versionEndExcluding":"3.5.0","matchCriteriaId":"79F68470-2337-4679-B873-196E60199AAE"}]}]}],"references":[{"url":"https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","source":"disclosure@vulncheck.com","tags":["Product","Release Notes"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg","source":"disclosure@vulncheck.com","tags":["Release Notes","Third Party Advisory"]}]}}