CVE-2026-41035Disclosure(samba / rsync)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch samba rsync systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

samba CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://www.openwall.com/lists/oss-security/2026/04/16/2

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-130CWE-805

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

rsync

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-04-16); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

samba

Products

rsync

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Disclosure

240.0%

General

240.0%

Patch

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-16	2	Disclosure1General1
2026-04-19	1	Disclosure1
2026-04-24	1	Patch1
2026-05-20	1	General1

Full discourse5 posts

Open Source Security mailing list@oss_security174d
Disclosure
CVE-2026-41035: rsync: Use-After-Free via qsort Out-of-Bounds in receive_xattr() https://www.openwall.com/lists/oss-security/2026/04/16/2 Affected: rsync 3.0.1 through 3.4.2dev (all versions with xattr abbreviation) run with -X (--xattrs). Attack vector: Network (malicious rsync sender). 0-day, unofficial fix.
Post summary
The post discloses a zero‑day use‑after‑free flaw in rsync’s xattr handling, affecting all 3.x versions with -X, and notes an unofficial fix.
04082865
4.7K followersView on X
Ferramentas Linux@Cezar_H_Linux143d
General
Stop waiting for patches. CVE-2026-41035 is just today‘s symptom. The real skill? Writing your own detection tools. Read more -> http://tinyurl.com/2s3nkva5 #Security https://t.co/aUD1uAC4Jq
Post summary
The tweet urges users not to wait for patches for CVE-2026-41035 and encourages building detection tools, providing no technical or exploit details.
2000065
1.5K followersView on X
Giuseppe Paternicola@giuseppe_1337170d
Patch
🚨 HIGH SEVERITY: CVE-2026-41035 (CVSS 7.4) rsync 3.0.1-3.4.1 use-after-free vulnerability when using -X/--xattrs flag. Linux systems widely affected. Patch immediately if using extended attributes. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/ITM8470DKz
Post summary
The tweet reports a high‑severity use‑after‑free flaw in rsync 3.0.1‑3.4.1 triggered by the -X flag and urges users to apply the vendor patch immediately.
0000070
26 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds178d
General
CVE-2026-41035 Use-After-Free Vulnerability in rsync 3.0.1 Through 3.4.1 Receive Xattr https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41035
Post summary
The text briefly announces a use‑after‑free vulnerability in rsync (CVE-2026‑41035) but provides only minimal technical detail and no information on exploits, patches, or real‑world impact.
0000040
4.0K followersView on X
CVE@CVEnew178d
Disclosure
CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync w… https://www.cve.org/CVERecord?id=CVE-2026-41035
Post summary
A use‑after‑free vulnerability (CVE‑2026‑41035) has been disclosed for rsync versions 3.0.1 through 3.4.1, triggered by an untrusted length value in a qsort call.
0000040
57.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	samba	rsync	-	-	-

Explore more

Back to dashboard samba CVEs rsync vulnerabilities

What researchers are saying

CVE-2026-41035

Giuseppe Paternicola[verified]@giuseppe_1337Patch

The tweet reports a high‑severity use‑after‑free flaw in rsync 3.0.1‑3.4.1 triggered by the -X flag and urges users to apply the vendor patch immediately.

Open Source Security mailing list@oss_securityDisclosure

The post discloses a zero‑day use‑after‑free flaw in rsync’s xattr handling, affecting all 3.x versions with -X, and notes an unofficial fix.

Ferramentas Linux@Cezar_H_LinuxGeneral

The tweet urges users not to wait for patches for CVE-2026-41035 and encourages building detection tools, providing no technical or exploit details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text briefly announces a use‑after‑free vulnerability in rsync (CVE-2026‑41035) but provides only minimal technical detail and no information on exploits, patches, or real‑world impact.

CVE@CVEnewDisclosure

A use‑after‑free vulnerability (CVE‑2026‑41035) has been disclosed for rsync versions 3.0.1 through 3.4.1, triggered by an untrusted length value in a qsort call.