rootpwn

high · CVSS v3 8.1

CVE-2026-61548

Rsyslog versions 7.5.4 through 8.2605.0 contain a stack-based buffer overflow vulnerability in the optional mmpstrucdata plugin's parseSD_PA

Overview

Rsyslog versions 7.5.4 through 8.2605.0 contain a stack-based buffer overflow vulnerability in the optional mmpstrucdata plugin's parseSD_PARAM function. The flaw occurs when parsing RFC5424 structured-data parameters without proper bounds checking, allowing a remote unauthenticated attacker to trigger a stack overwrite via specially crafted log messages. This vulnerability matters because it can lead to service crashes and interruption of critical log collection infrastructure.

Description

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.

Impact

Integrity and Availability are impacted due to potential stack corruption and denial of service via application crashes. Unauthenticated remote attackers who can send crafted RFC5424 log messages to an affected Rsyslog action are impacted. Confidentiality is not directly affected, and remote code execution has not been demonstrated.

Remediation

Upgrade Rsyslog to version 8.2606.0 or later where the issue is resolved. If upgrading immediately is not possible, disable the optional mmpstrucdata plugin or restrict effective message size limits below the vulnerable threshold to mitigate exposure.

Risk context

The vulnerability is rated as high severity with a CVSS v3 score of 8.1, indicating significant risk to log availability. EPSS data is not currently available for this identifier, but urgency should be guided by exposure to untrusted log sources and utilization of the affected mmpstrucdata plugin.

Affected products

  • Rsyslog mmpstrucdata plugin 7.5.4 to 8.2605.0

Scores

Severity
high
CVSS v2
7.6
CVSS v3
8.1
CVSS v4
—
EPSS
—

Rsyslog Buffer Overflow Stack Overflow Log Processing Denial of Service RFC5424 High Severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-46655

A local integer overflow vulnerability exists in the virtio-win Viosock driver for Windows guests running on QEMU and KVM. A low-privilege local user can supply specially crafted inputs via IOCTL_SELECT to cause kernel heap memory corruption. This issue matters because it enables local privilege escalation within the guest operating system.

View analysis

high

CVE-2026-55556

Rsyslog versions 8.2110.0 through 8.2604.0 contain a heap-based memory corruption vulnerability in the optional imhttp module. An unauthenticated remote attacker can trigger this flaw by sending an oversized HTTP Basic Authorization header to an affected endpoint. This causes incorrect buffer allocation and adjacent memory overwrite, resulting in a denial of service.

View analysis