CVE-2026-78002

Published: Ago 27, 2026 Last Modified: Ago 27, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

131

Incorrect Calculation of Buffer Size

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart Execute Unauthorized Code Or Commands Read Memory Modify Memory
Applicable Platforms
Languages: Memory-Unsafe, C, C++
Likelihood of Exploit: High
View CWE Details
https://access.redhat.com/security/cve/CVE-2026-78002
https://access.redhat.com/security/cve/CVE-2026-78002
https://bugzilla.redhat.com/show_bug.cgi?id=2521135
https://bugzilla.redhat.com/show_bug.cgi?id=2521135
https://github.com/rsyslog/rsyslog/security/advisories/GHSA…
https://github.com/rsyslog/rsyslog/security/advisories/GHSA-g72f-gc6v-f2w3