CVE-2026-70457 is an out-of-bounds write in rsync's parse_size_arg() function where the return value of snprintf() is used directly as an array index without bounds validation. This is the same flaw CERT advisories ARR38-C and FIO47-C have warned about since 2006—seen in Linux kernel drivers (CVE-2019-14895), OpenSSH, and now rsync. It's not a novel vulnerability class, but it is a persistent one, and rsync's deployment context makes the blast radius potentially severe.
The mechanism: snprintf() returns the number of characters that would have been written, not the number actually written. When truncation occurs, that return value exceeds your buffer size. Using it as an index writes past the array boundary into .bss memory. In parse_size_arg(), the trigger is predictable—specific input lengths that cause truncation can be calculated precisely, making exploitation deterministic in a way heap corruption rarely is.
What makes this noteworthy isn't the bug itself but where rsync runs. rsync sits in backup pipelines, container image distribution, system synchronization jobs—often running as root or in privileged containers. The .bss corruption may not yield direct code execution, but corrupting adjacent state structures (file lists, connection handles, state machines) in these trust chains can enable lateral movement or data poisoning without ever touching execution. The CVSS 6.5 reflects exploitability in isolation, not cascade potential through rsync's downstream dependencies.
Static analysis tools can catch this pattern with proper taint and bounds tracking, and CodeQL has checkers for potentially exceeding buffer bounds. The gap isn't detection capability—it's that developers suppress warnings they don't understand, or make pragmatic trades at high-cognitive-load call sites like size parsing. The function likely compiled without warnings, ran without crashes in typical use, and waited silently for the specific input length that triggers truncation. This is code entropy: a function written for one threat model (human operators) calcified in place while rsync was retrofitted into automated build pipelines where adversarial input lengths are realistic.
Remediation: patch to 3.5.0 or later. More importantly, audit the rsync codebase for other snprintf() return-value-as-index patterns—the same systemic gap that allowed this to survive 3.2.3 through 3.5.0 may exist elsewhere. In trust-chain deployments, prioritize patching not just for the vulnerability but for the disclosed-but-unfixed window where attackers can correlate version fingerprints with known trigger conditions.