CVE-2026-78002

rsyslog contains a heap buffer overflow (CWE-131) in the RainerScript replace() function, caused by an incorrect buffer size calculation during string replacement that leads to memory corruption. An unauthenticated remote attacker can trigger the flaw by sending specially crafted syslog messages to a system whose rsyslog configuration invokes replace() on message content. Successful exploitation crashes the rsyslog daemon and causes denial of service; the CVSS vector (C:N/I:N/A:H) indicates no confidentiality or integrity impact. Systems running rsyslog that process remotely supplied messages through templates, rulesets, or filters using the replace() function are affected, while configurations that never call the function do not reach the vulnerable code path. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a ~0.6% probability of exploitation in the next 30 days (47th percentile).

What to do: Audit rsyslog configurations (templates, rulesets, and action filters) for use of the replace() function; if present, apply the fixed rsyslog package from your distribution or upstream as soon as an advisory with fixed versions is published, since the data does not yet specify fixed version numbers. Until patching, restrict access to syslog ports (UDP/TCP 514 and RELP) to trusted senders with firewall rules so only authorized sources can reach the daemon. Monitor rsyslog for unexpected restarts or crashes, which would indicate attempted exploitation.