Skip to content

GHSA-78jc-79jv-v6rw on CTRL-OS 26.05

Aliases: GHSA-78jc-79jv-v6rw, CVE-2026-70456

Packages: rsync

Status: Plausible

Advisory Information

A remote daemon client can make glob expansion land argc exactly on maxargs, after which argv[argc] = NULL wrote one pointer (eight bytes on 64-bit) past the end of the allocation. The fix reserves the missing slot.

The ASan regression constructs the 995-file boundary precisely and drives it through a real daemon.

Affected: 3.0.1 through 3.4.4

Fixed in: 3.5.0 (io.c, reserving the trailing-NULL slot)

Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)

Test: io-readargs-argv-nullwrite (ASan)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”