Description

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:20:29.367Z",
  "pubdate": "2026-08-27T17:20:29.367Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability has been identified within the rsyslog logging daemon, specifically impacting the RainerScript replace() function.\nThis security flaw is triggered when the application processes maliciously crafted syslog messages, leading to memory corruption due to an erroneous buffer size calculation.\nThe vulnerability allows an unauthenticated, remote attacker to trigger a crash of the rsyslog service, resulting in a Denial of Service (DoS) condition.\nBecause the flaw occurs during the string replacement operations inherent to RainerScript, the system is susceptible to exploitation over the network without requiring any prior authentication or privileged access to the host.\nThe risk implication is significant for environments relying on rsyslog for centralized log management, as successful exploitation disrupts the integrity and availability of log ingestion processes.\nAdministrators are advised to monitor official vendor security channels for patch availability and consider limiting network exposure of the syslog listener.",
  "technicalDetails": "The vulnerability resides within the RainerScript engine, specifically affecting the implementation of the replace() function. RainerScript is the configuration and scripting language used by rsyslog to manipulate message properties and perform string transformations.\nThe root cause of this vulnerability is an integer-related calculation error during the string replacement routine. When replace() is invoked, the function must allocate a new buffer to accommodate the modified string. A flaw in how the length of the result string is computed leads to an undersized allocation on the heap.\nThe attack flow begins when an attacker sends a specially crafted syslog message to a system configured to process logs via RainerScript rules containing a replace() operation. As the engine executes the script, it passes the input message to the affected function. Because the buffer size calculation is insufficient, the operation results in a heap-based buffer overflow, wherein memory contents beyond the boundaries of the allocated buffer are overwritten.\nThis memory corruption typically leads to immediate heap instability. When the application attempts to access or free the corrupted heap chunk, the memory management system detects the inconsistency, leading to a process crash. This effectively terminates the rsyslog daemon, preventing it from processing further logs until a service restart is performed.\nWhile the primary impact described is a Denial of Service, heap overflows inherently risk arbitrary code execution if the memory corruption is precise enough to overwrite function pointers or other critical control structures. However, in the context of this vulnerability, the primary exploitation vector is the destabilization of the heap memory layout causing a service crash.\nThe vulnerability is remotely exploitable as it does not require authentication or localized user interaction; the rsyslog process exposes itself to the network to ingest syslog data, making it a primary target for external malicious packets containing the payload. Successful exploitation hinges on the configuration of rsyslog rules; if the replace() function is utilized in processing incoming syslog traffic, the system is effectively exposed."
}