rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

Description

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Timeline

Scores

EPSS (exploitation in 30 days)

0.38% · top 68% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Weakness

• CWE-131 Incorrect Calculation of Buffer Size (opens in a new tab)All about CWE-131 and its CVEs
• CWE-787 Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• RsyncProject · rsync

  • affected 3.2.3 – ≤ 3.4.4
  • unaffected 3.5.0

References (3)

• GitHub Security Advisory (GHSA-pg7g-xqmr-xpfh) (opens in a new tab)vendor-advisory
• rsync 3.5.0 Release Notes (opens in a new tab)release-notes
• https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-70457](https://trackcve.app/badge/CVE-2026-70457.svg)](https://trackcve.app/cve/CVE-2026-70457)

Record last updated 14 Aug 2026, 16:51 UTC.