CVE-2026-70457

An out-of-bounds write vulnerability in rsync's parsesizearg function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001407)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001407 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dpdscclockenread' Tell snprintf to store at...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2024-002887)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002887 advisory. In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since devsearchpath can technically be as lar...

Linux Distros Unpatched Vulnerability : CVE-2026-80580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulat...

SUSE CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

Incorrect Calculation of Buffer Size

Overview Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size in the parsesizearg function. An attacker can cause memory corruption by providing specially crafted input that leads to an out-of-bounds write when the return value of snprintf is used as an array...

AZL-95846 CVE-2026-70457 affecting package rsync for versions less than 3.5.0-1

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

ALPINE-CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

EUVD-2026-58047

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457: Incorrect Calculation of Buffer Size

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

PT-2026-71657

Name of the Vulnerable Software and Affected Versions rsync versions 3.2.3 through 3.4.x Description An out-of-bounds write exists in the parse size arg function. The issue occurs because the return value of snprintf is used as an index for a .bss-segment array without proper bounds checking. Whe...

CVE-2026-64028

A flaw was found in the Linux kernel's tracing subsystem. The histfieldname function, responsible for handling field names, can return a NULL value if a long variable name in a fully-qualified reference causes snprintf truncation. This unexpected NULL return can lead to a NULL pointer dereference...

EUVD-2026-45660

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

PT-2026-61204

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overrun occurs in the iscsi encode text output function when concatenating records into the rsp buf buffer. The function uses sprintf to append key-value pairs without verifying t...

BIT-MODSECURITY-2026-52761 ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8tounicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a...

CVE-2026-52761 ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8tounicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a...