CVE-2026-41035 — Improper Handling of Length Parameter Inconsistency in Samba Rsync

CWE-130 — Improper Handling of Length Parameter Inconsistency3 documents3 sources
Severity
7.4HIGHNVD
EPSS
0.0%
top 97.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Samba Rsync
Timeline
PublishedApr 16

Description

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LExploitability: 3.1 | Impact: 3.7

Affected Packages1 packages

▶CVEListV5samba/rsync3.0.1 — 3.4.1

🔴Vulnerability Details

2
VulDB
Samba rsync up to 3.4.1 Qsort Call receive_xattr length length parameter↗2026-04-16
▶
CVEList
CVE-2026-41035: In rsync 3↗2026-04-16
▶