rsync Out-of-bounds Write Vulnerability (CVE-2026-7048) Analysis and POC

Vulnerability Overview Vulnerability Name: rsync: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H Description: A malicious peer marked a file entry with FLAG_HLINKED even though hard links were not registered (-H absent), and the receiver accepted this flag. Accepting FLAG_HLINKED on a directory entry is a second error, as the same fix applies: the demonstrated write occurred on a regular file. The FLAG_HLINKED_BUMP/IOPT_EXTRA offset calculation for such an entry resulted in attacker-supplied bytes being placed beyond the memory allocated for that entry. Exploitation Conditions: Requires protocol-30 incremental recursion, regular files, -checksum in use, and -H absent. Additional hard link slots are only preserved when is set, and the out-of-bounds write occurs via . Remediation: Reject FLAG_HLINKED when hard links are not in use, and reject it on directory entries. Impact Scope Affected Versions: 3.0.0 through 3.4.4 Fixed Versions: 3.5.0 (includes fixes for partial malicious peer robustness work) Remediation Fixed Version: 3.5.0 Fix Details: Reject FLAG_HLINKED when hard links are not in use, and reject it on directory entries. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: Low - Availability: High CVE ID: CVE-2026-7048 Weaknesses: CWE-787 Credits: gregh POC Code Test: proto-flag-hlink-oob

Goal Reached Thanks to every supporter — we hit 100%!

rsync Out-of-bounds Write Vulnerability (CVE-2026-7048) Analysis and POC

More from this source