🚨 HIGH - Rsync receiver integer overflow leaks process memory (CVE-2026-44508) Rsync before 3.4.3 is vulnerable in the receiver’s compressed-token decoder, where a malicious sender can trigger out-of-bounds reads and memory disclosure. The root cause is an integer overflow from an unchecked 32-bit signed counter during token decoding. Exploitation is achievable by an attacker who can act as or control the rsync sender and deliver crafted compressed token streams to a vulnerable receiver during a sync session. Impact is sensitive process-memory leakage (environment variables, passwords/secrets, and heap/stack/library pointers), which can weaken ASLR and materially increase the success rate of follow-on exploitation. 👉 Affected: rsync < 3.4.3 | Upgrade to 3.4.3
Post summary
A weakness in rsync versions prior to 3.4.3 allows integer‑overflow‑based memory disclosure; applying the 3.4.3 update resolves the issue.
