CVE-2026-70459: Samba Rsync

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.

Affected products

• Samba Rsync: from 3.0.0, before 3.5.0 (fixed in 3.5.0)

Published 2026-08-13. Last modified 2026-08-31.