CVE-2026-78002: rsyslog Incorrect Calculation of Buffer Size

CVSS: 7.5v3.1HighAwaiting analysis

AliasesRHSA-2026:69540RHSA-2026:69541UBUNTU-CVE-2026-78002+3 more

Published 27-08-2026Last modified 20-10-2026

Vulnerability summary

CVE-2026-78002 is a high (CVSS 7.5) Incorrect Calculation of Buffer Size vulnerability in rsyslog. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.6% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.82%

0%100%

Low · +0.21 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1

RHSA-2026:80817 RHSA-2026:84576 SUSE-SU-2026:4611-1

Timeline

27-08-2026
PublishedVulnerability first disclosed.
20-10-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

0.82%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

+0.21 pp

From 0.61% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.82%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Affected systems

Redhat41 products

rsyslog< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-crypto< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-crypto-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-debugsource< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2

rsyslog-doc< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-elasticsearch< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-elasticsearch-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-gnutls< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-gnutls-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-gssapi< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-gssapi-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-kafka< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-kafka-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-logrotate< 0:8.2510.0-2.el9_8.2
rsyslog-mmaudit< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-mmaudit-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-mmfields< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-mmfields-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-mmjsonparse< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-mmjsonparse-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-mmkubernetes< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-mmkubernetes-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-mmnormalize< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-mmnormalize-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-mmsnmptrapd< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-mmsnmptrapd-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-mysql< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-mysql-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-omamqp1< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-omamqp1-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-openssl< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-openssl-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-pgsql< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-pgsql-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-relp< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-relp-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-snmp< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-snmp-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2
rsyslog-udpspoof< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2 | < 0:8.2412.0-1.el10_0.2
rsyslog-udpspoof-debuginfo< 0:8.2510.0-2.el9_8.2 | < 0:8.2510.0-5.el10_2.2

Show all 41

Debian1 product

rsyslogAll versions (No fix recorded) | < 8.2504.0-1+deb13u2 | < 8.2608.0-4

Ubuntu1 product

rsyslog< 8.16.0-1ubuntu3.1+esm3 | < 8.32.0-1ubuntu4.2+esm1 | < 8.2001.0-1ubuntu1.3+esm1 | < 8.2112.0-2ubuntu2.5 | < 8.2312.0-3ubuntu9.4 | < 8.2512.0-1ubuntu4.2

3 vendors · 43 products