CVE-2026-70458: Rsyncproject Rsync

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.

Affected products

• Rsyncproject Rsync: from 3.0.0, up to and including 3.4.4

Published 2026-08-13. Last modified 2026-09-08.