CVE-2026-70458

rsync 3.0.0–3.4.x are affected by an out-of-bounds write caused by incorrect HLINK_BUMP handling for file entries with FLAG_HLINKED when hard-link preservation is disabled. The issue stems from a missing F_SUM field in the file_struct layout, allowing memory corruption past the end of the allocat...

CVE-2026-70458

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...