CVE-2026-41035

CVE-2026-41035 is a use-after-free vulnerability in rsync versions 3.0.1 through 3.4.1 that is triggered during extended attributes (xattrs) processing. The flaw exists in the receive_xattr function, which relies on an untrusted length value during a qsort operation, potentially allowing memory corruption. The vulnerability requires users to run rsync with the -X or --xattrs flag enabled, with non-Linux platforms being more widely affected than Linux systems due to configuration differences. The vulnerability carries a CVSS 3.1 score of 7.4 (HIGH) with a network attack vector, low complexity, and low privileges required for exploitation. It can result in confidentiality, integrity, and availability impacts across system scope. The EPSS score of 0.00032 indicates this is not yet a widespread threat in the wild compared to other CVEs. There is currently no evidence of active exploitation, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The threat level remains relatively low in the broader threat landscape, as indicated by the inactive status on threat intelligence hot lists. Organizations should nevertheless prioritize patching rsync installations where xattrs functionality is actively used, particularly on non-Linux platforms.