CVE-2026-41035: samba rsync
Vulnerability summary
CVE-2026-41035 is a high (CVSS 7.8) vulnerability in samba rsync. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 16-04-2026PublishedVulnerability first disclosed.
- 04-09-2026Last modifiedVulnerability information updated.
Description
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.10 pp
From 0.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-805Buffer Access with Incorrect Length ValueThe product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Affected systems
Redhat5 products
- rsync< 0:3.1.3-25.el8_10 | < 0:3.4.1-6.el10_2 | < 0:3.1.3-20.el8_8.5 | < 0:3.1.3-12.el8_4.7 | < 0:3.1.2-12.el7_9.3 | < 0:3.0.6-12.el6_10.3 | < 0:3.1.3-14.el8_6.10 | < 0:3.2.3-9.el9_0.5
- rsync-daemon< 0:3.1.3-25.el8_10 | < 0:3.4.1-6.el10_2 | < 0:3.1.3-12.el8_4.7 | < 0:3.2.3-9.el9_0.5
- rsync-debuginfo< 0:3.1.3-25.el8_10 | < 0:3.4.1-6.el10_2
- rsync-debugsource< 0:3.1.3-25.el8_10 | < 0:3.4.1-6.el10_2
- rsync-rrsync< 0:3.4.1-6.el10_2
Alpine1 product
- rsync≥ 3.0.1, < 3.4.1-r2
Debian1 product
- rsync< 3.2.7-1+deb12u5 | < 3.4.1+ds1-5+deb13u2 | < 3.4.2+ds1-1
Mageia1 product
- rsync< 3.2.7-1.4.mga9
Opensuse1 product
- rsync&distro=openSUSE Tumbleweed< 3.4.1-5.1
Samba1 product
- rsync≥ 3.0.1, ≤ 3.4.1
Ubuntu1 product
- rsync< 3.1.0-2ubuntu0.4+esm3 | < 3.1.1-3ubuntu1.3+esm5 | < 3.1.2-2.1ubuntu1.6+esm3 | < 3.1.3-8ubuntu0.9+esm1 | < 3.2.7-0ubuntu0.22.04.6 | < 3.2.7-1ubuntu1.4 | < 3.4.1+ds1-5ubuntu1.2 | < 3.4.1+ds1-7ubuntu0.2
7 vendors · 11 products
References
53 links- www.openwall.com/lists/oss-security/2026/04/16/2WEBARTICLEREPORTExploitMailing ListThird Party Advisory
