CVE-2026-61548

HIGH

8.1

CVSS v3

Description

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.

CWE-121Stack-based Buffer Overflow

How to fix

Remediation Available

rsyslogDebian

Fixed in:8.2504.0-1+deb13u2CVE-2026-61548

Fixed in:8.2606.0-4CVE-2026-61548

rsyslogUbuntu

Fixed in:8.2112.0-2ubuntu2.4USN-8598-1

Fixed in:8.2312.0-3ubuntu9.3USN-8598-1

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

EPSS data unavailable for this CVE.

References

Other references4

Related Vulnerabilities

Other CWE-121 (Stack-based Buffer Overflow) vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2025-22457	Critical	9.0	100%	KEV + Ransom	Fix
CVE-2025-0282	Critical	9.0	100%	KEV + Ransom	-
CVE-2021-20038	Critical	9.8	100%	KEV + Ransom	-
CVE-2009-0927	High	8.8	97%	KEV	Fix
CVE-2020-10924	High	8.8	87%	-	-
CVE-2022-20705	Critical	10.0	80%	-	-

Common questions

How do I fix CVE-2026-61548?

Published advisories record a fix for 2 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

How severe is CVE-2026-61548?

CVE-2026-61548 has a CVSS v3 base score of 8.1, rated high. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2026-61548 affect?

Published advisories record a fix for rsyslog (Debian), rsyslog (Ubuntu). Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.

Embed a live status badge for CVE-2026-61548

Markdown

[![CVE-2026-61548](https://tridentstack.com/cve/badge/CVE-2026-61548.svg)](https://tridentstack.com/cve/CVE-2026-61548)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-61548"><img src="https://tridentstack.com/cve/badge/CVE-2026-61548.svg" alt="CVE-2026-61548"></a>

Check your Linux endpoints for this class of vulnerability

TridentStack Control continuously scans Linux endpoints for known vulnerabilities and deploys the fixes from the same console. 200 endpoints free forever, no credit card.

Patch your fleet free Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-09-18.