CVE WatchJul 14, 2026

CVE-2026-45232

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in so

CVSS

3.1

Low

EPSS

0.3%

p27

KEV

—

Exploit Today

0-100

Published: May 20, 2026 · Last modified: Jul 14, 2026 · CWE-193

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-08-182026-09-14

Technical description

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-760815.5 MED

—

——0ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed. This issue has been fully resolved in version 4.16.0. There are no configuration workarounds. Upgrading to a patched version is the only way to trigger the automatic cleanup migration. Those who cannot upgrade immediately should manually review user permissions specifically for Granted Projects where multiple roles were recently deleted.10h CVE-2026-907814.4 MED

7.6%

——2alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.3d CVE-2026-813967.8 HIG

35.3%

——11Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.7d CVE-2026-696095.5 MED

33.2%

——10Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.7d CVE-2026-862978.1 HIG

62.3%

——19A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.7d CVE-2026-81738—

26.1%

——8OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries7d