CVE-2026-41035
Published: 16 April 2026
Summary
CVE-2026-41035 is a high-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Samba Rsync. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-41035 is a use-after-free vulnerability (CWE-130) in rsync versions 3.0.1 through 3.4.1, stemming from the receive_xattr function's reliance on an untrusted length value passed to a qsort call. The flaw affects rsync receivers when invoked with the -X (or --xattrs) option to handle extended attributes. On Linux systems, many but not all common configurations are vulnerable, while non-Linux platforms face broader exposure.
Exploitation is network-accessible (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), resulting in a scope change (S:C) and low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 7.4. An attacker acting as a sender can trigger the issue against a victim receiver processing extended attributes, potentially leading to memory corruption.
Advisories and patches are detailed in Rsync GitHub issue #871 and the project's releases page, with additional discussions in oss-security mailing list posts from April 2026, including announcements on April 16 and 22.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23215
Vulnerability details
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable.…
more
Non-Linux platforms are more widely vulnerable.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable use-after-free in the rsync receiver (network-accessible with AV:N), directly enabling exploitation of a public-facing or network-exposed service for memory corruption.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely flaw remediation, directly addressing the use-after-free vulnerability in rsync by mandating application of patches from advisories like Rsync GitHub issue #871.
Implements memory protection controls such as address space layout randomization and stack canaries to minimize successful exploitation of use-after-free flaws like the one in rsync's receive_xattr.
Enforces least functionality by prohibiting or restricting the --xattrs option in rsync configurations, eliminating the vulnerable code path triggered by untrusted length values.