Description

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T15:19:43.527Z",
  "pubdate": "2026-08-13T15:19:43.527Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the sender-side block matching logic of rsync before version 3.5.0.\nThe vulnerability allows a malicious receiver to trigger unauthorized memory access before the start of an allocated buffer by sending a specially crafted checksum block.\nThe primary impact of this vulnerability is the potential exposure of sensitive file data buffer memory on the sender side through an out-of-bounds read operation.\nAffected systems include any deployments running vulnerable versions of rsync prior to 3.5.0 that engage in synchronization processes with untrusted peers.\nAttack capabilities are constrained to reading memory locations adjacent to the file data buffer, contingent on the ability to interact with the sender as a receiver and supply malicious checksum sets.\nExploitation requires the attacker to transmit a crafted checksum block characterized by a length of zero during the delta computation phase.",
  "technicalDetails": "The root cause of the vulnerability lies within the sender-side block matching logic during the delta computation phase of the rsync protocol.\nSpecifically, when a receiver supplies a crafted checksum set containing a zero-length block, the internal calculation logic fails to appropriately validate the input parameters.\nThis zero-length block forces a negative offset calculation during delta computation.\nConsequently, the memory access pointer is directed prior to the start of the allocated file data buffer memory on the sender side.\nWhen the sender processes this invalid offset, it performs an out-of-bounds read, accessing adjacent memory regions outside the intended buffer boundaries.\nThe vulnerable component resides in the sender-side checksum and block matching routines responsible for processing synchronization deltas.\nAffected software versions include all rsync implementations prior to version 3.5.0.\nRegarding authentication and privileges, the attack scenario typically involves the network exposure inherent to rsync server configurations or remote shell integrations, where a connecting receiver interacts directly with the sender's synchronization engine.\nThe payload behavior involves the transmission of a maliciously structured checksum sequence designed explicitly to exploit the arithmetic flaw in offset determination.\nStep-by-step, exploitation occurs as follows: first, the malicious receiver establishes a synchronization session with the rsync sender; second, the receiver submits a crafted checksum set containing a block with a length of zero; third, the sender processes this checksum set during the delta computation phase; fourth, the zero-length block triggers a flawed negative offset calculation; and fifth, the sender attempts to read from memory addresses preceding the allocated file data buffer, resulting in an out-of-bounds memory read."
}