A stack-based buffer overflow vulnerability in the rsyslog mmpstrucdata plugin allows remote unauthenticated attackers to trigger a service crash or potentially manipulate memory.

The vulnerability exists in the parseSD_PARAM function within the mmpstrucdata plugin, which fails to enforce destination size constraints during buffer operations. A remote unauthenticated attacker can exploit this by sending a specially crafted RFC5424 message containing an oversized parameter, provided the plugin is enabled and the message size limit allows it.

Successful exploitation of this flaw leads to a denial of service by crashing the rsyslog daemon, which disrupts centralized log collection and security monitoring capabilities. Given the CVSS score of 8.1, the high severity reflects the potential for significant operational impact and the ability of an unauthenticated remote actor to compromise availability without user interaction.

Immediate Action: Update rsyslog to version 8.2606.0 or later to include the necessary buffer size checks.

Proactive Monitoring: Monitor system logs for repeated rsyslog process crashes or restarts, which may indicate attempted exploitation.

Compensating Controls: If upgrading is not immediately feasible, disable the mmpstrucdata plugin in the rsyslog configuration or implement network-level filtering to restrict access to the logging infrastructure.

Public Exploit Available: No

Organizations should prioritize patching their rsyslog deployments to version 8.2606.0 to eliminate this risk. Because log integrity and availability are foundational to security operations, ensuring that the logging subsystem is resilient against remote crashes is critical for maintaining overall infrastructure visibility and forensic readiness.