Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
rclone crashes when processing malformed large WEBP image on 32-bit
published 5 days ago
Summary
The rclone file‑sync tool can stop working if it tries to read a specially crafted WEBP picture that reports an unrealistically large size on a 32‑bit system. This may cause temporary service interruptions until the program is restarted. Update rclone to a version that includes the fix or avoid handling such WEBP files on 32‑bit machines.
What to do
- Update cleanstart rclone to version 1.74.3-r0.
- Update cleanstart rclone to version 1.73.5-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | rclone |
< 1.74.3-r0 < 1.73.5-r0 Fix: upgrade to 1.74.3-r0
|
Original advisory text
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms
Security vulnerability affects the rclone package. Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-TP51986 · OSV
Track software like this
Free during beta