---
id: CVE-2026-70456
title: "rsync 3.0.1 before 3.5.0\_contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list"
summary: "rsync 3.0.1 before 3.5.0\_contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv…"
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-787
published: '2026-08-13'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:28:37.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70456'
references:
  - url: 'https://github.com/RsyncProject/rsync/releases/tag/v3.5.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70456.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-70456'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515395'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-70456'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70456'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67463'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67462'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00541
epssPercentile: 0.43135
ingestedAt: '2026-09-08T21:11:12.277Z'
vendor: Red Hat
product: Red Hat Enterprise Linux BaseOS (v. 10)
affected:
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - openshift_container_platform 4
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_10
  - enterprise_linux_baseos_v_9
patched:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_10
  - enterprise_linux_baseos_v_9
---

## Overview

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:67463** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67463)
- **RHSA-2026:67462** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67462)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70456.json)