THREAT INTELLIGENCE REPORT — CVE-2026-70457

Executive Summary

CVE-2026-70457 is an out-of-bounds write vulnerability in rsync versions 3.2.3 through 3.4.x, located in the parse_size_arg() function. The flaw allows a remote, unauthenticated attacker to corrupt .bss memory segments by triggering an snprintf() truncation condition during size-argument parsing, resulting in limited integrity impact and high availability impact. As of the analysis date, no patch is available from any tracked source, and the vulnerability remains unpatched in all affected versions.

Technical Analysis

Vulnerability Class: CWE-131 — Incorrect Calculation of Buffer Size

Affected Component: parse_size_arg() — a function used to parse and validate size-related command-line arguments (e.g., --max-size, --min-size, --bwlimit style parameters) in rsync.

Root Cause: The vulnerability stems from a fundamental misuse of the snprintf() return value. In C, snprintf() returns the number of characters that would have been written to the destination buffer had it been large enough — not the number of characters actually written. When the formatted string exceeds the destination buffer size, snprintf() truncates the output but returns the full (untruncated) length.

In parse_size_arg(), this return value is used directly as an index into a .bss-segment array without any bounds checking. Under normal conditions, where the formatted size string fits comfortably within the buffer, the return value is small and the indexed write stays within array bounds. However, when a specially crafted size string causes snprintf() to truncate, the return value reflects the total length of the would-be string — potentially far exceeding the actual array dimensions. The subsequent write operation targets memory at array_base + oversized_offset, landing outside the intended bounds and corrupting adjacent .bss memory.

Attack Surface:

• The attack surface is the rsync daemon (rsyncd) listening on TCP port 873 by default.
• The vulnerable function processes size arguments that may be supplied by remote clients during connection negotiation/session setup, or by local invocation with malicious arguments.
• Unauthenticated remote exploitation is possible per the CVSS vector (PR:N, AV:N), though attack complexity is rated High (AC:H) — likely due to the need to craft a specific size string that triggers the truncation boundary condition reliably.

Memory Corruption Specifics: The overflow targets the .bss segment — the region of memory holding uninitialized global/static variables. Corruption here can alter global state variables, flags, or configuration data used by the rsync process, potentially leading to denial-of-service (process crash) or unpredictable behavior. The CVSS vector indicates high availability impact (A:H) and low integrity impact (I:L), consistent with memory corruption causing process termination or state corruption.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template exists for this CVE as of the analysis date. The attack chain below is inferred from the vulnerability class and available CVE description.

Step 1 — Reconnaissance / Target Identification: An attacker identifies Internet-facing rsync daemons via port scanning (TCP 873) or Shodan-style search using queries such as "rsync" port:873. The attacker may also probe for rsync service banners to fingerprint the version and confirm it falls within the vulnerable range (3.2.3 ≤ version < 3.5.0).

Step 2 — Flaw Trigger: The attacker initiates a connection to the rsync daemon and attempts to transmit a specially crafted size argument that reaches parse_size_arg(). The payload must be a size string designed such that when formatted via snprintf() into the fixed buffer, the output exceeds the buffer capacity, forcing truncation. The attacker crafts the size string so that the character count that snprintf() would write (including the truncated portion) exceeds the length of the destination .bss-segment array.

Step 3 — Payload / Execution Method (Class-Level):

• Trigger condition: A size parameter containing an excessively long formatted representation (e.g., a number with extreme magnitude, or a string with unexpected formatting flags/units) that overflows the internal formatting buffer.
• Out-of-bounds write: The unchecked index wraps into adjacent .bss memory, corrupting global state.
• Impact vector: Depending on what data sits adjacent to the overflowed array, the attacker may corrupt: (a) internal buffer-size tracking structures, (b) connection state flags, or (c) process control variables — potentially causing a denial of service (crash) or altering rsync behavior.

Step 4 — Post-Exploitation Impact:

• Primary impact: Availability compromise — the corrupted .bss memory causes the rsync process to terminate (segfault) or enter an unrecoverable state, resulting in denial of service for legitimate rsync users.
• Secondary impact: Low-integrity impact — if the corrupted region controls security-relevant flags (e.g., path validation toggles), there is a theoretical risk of minor access-control bypass, though the CVSS scoring (I:L) indicates this is limited and not the primary outcome.
• Blast radius: Single affected rsync daemon instance. No lateral movement or data exfiltration capability is indicated by the vulnerability's impact scores.

Exploitation Prerequisite: The attack requires the attacker to understand and reliably trigger the snprintf() truncation boundary for the specific architecture/compiler build of the target rsync binary — contributing to the High attack complexity rating.

Impact Assessment

Detection Guidance

Sigma Rule

title: Rsync Out-of-Bounds Write Exploitation Attempt
id: 68a3b0e2-7c19-4f5d-9a3e-2c8d41f6b9e1
status: experimental
description: Detects malformed rsync size-argument connection attempts targeting CVE-2026-70457
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70457
tags:
    - attack.impact
    - cve.2026-70457
    - cwe.131
logsource:
    category: application
    product: rsync
detection:
    selection_connection:
        rsync.protocol: '31'
    selection_error_pattern:
        rsync.log|contains:
            - 'parse_size_arg'
            - 'ERROR: invalid size'
            - 'exceeds maximum'
            - 'out of memory'
    selection_abnormal_abort:
        rsync.process_exit_code:
            - '139'  # SIGSEGV
            - '134'  # SIGABRT
    condition: selection_connection and (selection_error_pattern or selection_abnormal_abort)
    timeframe: 5m
level: high
falsepositives:
    - Legitimate rsync clients using valid but large size limit values

YARA Rule

rule Rsync_Size_Arg_BSS_Overflow_CVE_2026_70457
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-04-08"
        description = "Detects payload patterns used to trigger parse_size_arg out-of-bounds write in rsync 3.2.3-3.4.x"
        cve = "CVE-2026-70457"
        cwe = "CWE-131"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-70457"

    strings:
        // Size argument with excessive digit count indicating overflow attempt
        $size_long = /--(?:max|min)-size=[0-9]{16,}/
        $size_bwlim = /--bwlimit=[0-9]{16,}/
        
        // Malformed size string with unexpected suffix chars to force formatting path
        $size_suffix_abuse = /(?:K|k|M|m|G|g|T|t|P|p)[0-9]{8,}/
        
        // Buffer overflow crash signature strings in logs
        $crash_sig_1 = "buffer overflow detected"
        $crash_sig_2 = "*** stack smashing detected ***"
        
    condition:
        uint16(0) == 0x5A4D or   // PE file (Windows rsync)
        uint32(0) == 0x464C457F  // ELF file (Linux rsync)
        and (
            any of ($size_*) or
            any of ($crash_sig_*)
        )
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"ET EXPLOIT Rsync parse_size_arg Out-of-Bounds Write Attempt (CVE-2026-70457)"; flow:to_server,established; content:"|20|--"; content:"size="; distance:0; within:20; content:"|3D|"; pcre:"/--(?:max|min)-size=\d{16,}/"; pcre:"/--(?:max|min)-size=\d{19,}/"; classtype:attempted-dos; reference:cve,2026-70457; sid:20267045701; rev:1; metadata:created_at 2026_04_08, updated_at 2026_04_08;)

Elastic Detection

sequence by process.entity_id with maxspan=2m
  [ process where
      event.action == "exec" and
      process.name == "rsync" and
      (
        process.args regex~ "--(max|min)-size=\d{16,}" or
        process.args regex~ "--bwlimit=\d{16,}"
      )
  ]
  [ process where
      event.code in ("SIGSEGV", "SIGABRT") and
      process.name == "rsync"
  ]

Splunk SPL Query

index=main sourcetype=linux:syslog OR sourcetype=rsyncd
| where like(_raw, "%parse_size_arg%") OR like(_raw, "%exceeds maximum%") OR like(_raw, "%invalid size%")
| eval is_long_size=if(match(_raw, "--(?:max|min)-size=\d{16,}") OR match(_raw, "--bwlimit=\d{16,}"), 1, 0)
| stats count BY src_ip, is_long_size, _time
| where is_long_size == 1
| eval threat="CVE-2026-70457 exploitation attempt"
| table _time, src_ip, dest_ip, is_long_size, count

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="100457" level="12" frequency="5" timeframe="300">
    <if_sid>100400</if_sid>
    <match>--max-size=|--min-size=|--bwlimit=</match>
    <regex>--(?:max|min)-size=\d{16,}|--bwlimit=\d{16,}</regex>
    <description>CVE-2026-70457: Possible rsync parse_size_arg out-of-bounds write attempt detected. Excessive size argument length.</description>
    <group>rsync_exploit,attack.dos,</group>
    <mitre>
      <id>T1499</id>
      <id>T1499.004</id>
    </mitre>
  </rule>

  <rule id="100458" level="14">
    <if_sid>100457</if_sid>
    <match>Segmentation fault|Aborted|core dumped</match>
    <description>CVE-2026-70457: rsync process crashed after suspicious size argument - possible exploitation success.</description>
    <group>rsync_exploit,attack.dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: ⚠ UNPATCHED — No patch evidence from any tracked source. No vendor fix, no commit reference, no release containing a fix.

Immediate Mitigations (no vendor patch available)

Critical: These are temporary measures. They reduce exposure but do NOT eliminate the underlying vulnerability.

Patch / Upgrade Steps

1. Identify affected instances: Inventory all hosts running rsync. Check with rsync --version — flag any version between 3.2.3 and 3.4.x inclusive.
2. Test upgrade: In a staging environment, install rsync 3.5.0 (or newer), verify functionality with your sync scripts/modules.
3. Deploy upgrade: Roll out rsync 3.5.0 to all production hosts. Restart rsyncd services.
4. Verify: Confirm rsync --version reports 3.5.0+ on all patched systems.
5. Follow vendor advisories: Monitor the rsync project (rsync.samba.org / rsync.samba.org/security.html) for the formal advisory and any additional guidance.

Long-Term Hardening

• Prefer SSH transport: Use rsync -e ssh instead of rsyncd for data synchronization between managed hosts. This eliminates the network attack surface on port 873 for rsync-specific vulnerabilities.
• Network segmentation: Ensure rsync daemons are never directly Internet-facing. Place them behind internal firewalls with strict ACLs.
• Authentication enforcement: If rsyncd is required, enforce module-level authentication (auth users, secrets file) even though this CVE does not require authentication — defense in depth.
• Patch management cadence: Subscribe to vendor security mailing lists; apply security patches within 48 hours for critical/network-reachable software.
• Harden builds: Rebuild rsync with compiler hardening flags (-fstack-protector-strong, -D_FORTIFY_SOURCE=2, ASLR/PIE) to reduce the practicality of memory-corruption exploitation.
• Regular vulnerability scanning: Include rsync in regular CVE scanning to catch future variants.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70457
2. rsync Project Security Page: https://rsync.samba.org/security.html (monitor for vendor advisory)*
3. CWE-131 Reference: https://cwe.mitre.org/data/definitions/131.html
4. CISA Known Exploited Vulnerabilities Catalog: Not listed (CISA KEV: NO) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. rsync Download/Releases: https://download.samba.org/pub/rsync/ (verify patched version availability)

Threat Actor Activity: No known threat actor campaigns, exploit-in-the-wild evidence, or public exploit code is available for CVE-2026-70457 as of this report date. The vulnerability is classified as unpatched with no public PoC. Continuously monitor FIRST.org EPSS and NVD updates for exploitation activity signals.

FINAL ASSESSMENT: CVE-2026-70457 is a remotely reachable, unauthenticated out-of-bounds write in rsync (3.2.3–3.4.x) that enables denial-of-service and limited integrity compromise. The unpatched status combined with rsync's frequent deployment in backup/replication infrastructure elevates organizational risk. Immediate containment via firewall restrictions or migration to SSH-based rsync is strongly recommended.