CVE-2026-43620: Samba Rsync

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.

Affected products

• Samba Rsync: up to and including 3.4.2

Published 2026-05-20. Last modified 2026-07-24.