Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-41035

CVE-2026-41035HIGH

Samba rsync — In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .0049   40.1     —

AFFECTED
  Product  Versions  Fixed
  rsync    3.0.1 –   —

TIMELINE
  Apr 16  Reserved by mitre
  Apr 16  Published (CNA: mitre)
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-41035 (Samba rsync). Public exploit reference added.
  Aug 24  RESCORED — CVE-2026-41035 (Samba rsync). CVSS 7.4 → 7.8 (NVD).
  Aug 27  EXPLOIT PUBLISHED — CVE-2026-41035 (Samba rsync). Public exploit reference added.
  Sep 4   EXPLOIT PUBLISHED — CVE-2026-41035 (Samba rsync). Public exploit reference added.

CWE-130, CWE-805 · CNA: mitre · CVSS v3.1 · 30 references · NVD status: Modified

Description

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Lifecycle

Complete event history — 6 events, chronological
Date	Event	Detail
April 16, 2026	Reserved	Reserved by mitre
April 16, 2026	Published	Published (CNA: mitre)
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-41035 (Samba rsync). Public exploit reference added.
August 24, 2026	RESCORED	RESCORED — CVE-2026-41035 (Samba rsync). CVSS 7.4 → 7.8 (NVD).
August 27, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-41035 (Samba rsync). Public exploit reference added.
September 4, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-41035 (Samba rsync). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Samba	rsync	—	3.0.1	—

Weaknesses

CWE-130 · CWE-805

References (30)

Authoritative record: CVE-2026-41035 at cve.org

Vendors: samba

Weaknesses: CWE-130 · CWE-805

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-41035 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.