---
id: CVE-2026-43618
title: "Rsync version\_3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receive…"
summary: "Rsync version\_3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receive…"
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
  - CWE-190
  - CWE-190
vendor: samba
product: rsync
affected:
  - rsync <= 3.4.2
published: '2026-05-20'
updated: '2026-09-01'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43618'
references:
  - url: 'https://github.com/RsyncProject/rsync/releases/tag/v3.4.3'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosure
    label: disclosure@vulncheck.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:26332'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:26408'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:26410'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:29197'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-43618'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2469054'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00805
epssPercentile: 0.54924
ingestedAt: '2026-09-02T12:43:47.048Z'
---

## Overview

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.

## Affected

- `rsync <= 3.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.