Description

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T15:19:59.343Z",
  "pubdate": "2026-08-13T15:19:59.343Z",
  "executiveSummary": "An out-of-bounds write vulnerability exists in rsync versions 3.0.1 through 3.4.x prior to 3.5.0 within the read_args() function. The flaw allows a malicious sender to execute a heap memory corruption attack by supplying a specially crafted argument list. Specifically, when the argument count precisely fills the allocated argv buffer, the trailing NULL terminator is written one slot past the boundary of the heap allocation.\nThis heap-based buffer overflow presents severe risk implications, potentially leading to arbitrary memory corruption, application crashes, or theoretical code execution depending on heap layout and compiler mitigations. The attack vector requires a malicious sender interacting with a vulnerable rsync receiver or client processing arguments supplied over the network or command channel.\nExploitation relies on manipulating the argument count during the parsing phase executed by the read_args() routine. Because rsync is frequently utilized in automated deployment pipelines, remote backups, and administrative synchronization tasks, successful exploitation could compromise critical infrastructure systems relying on vulnerable versions.",
  "technicalDetails": "The vulnerability resides in the read_args() function implemented within the rsync codebase, specifically affecting versions 3.0.1 up to 3.5.0. The root cause stems from an off-by-one boundary calculation error during memory allocation for the argument vector (argv). When the count of incoming arguments aligns in a specific manner with the internal sizing logic, the allocation size calculation fails to account for the necessary trailing NULL pointer terminator required to properly terminate standard C string arrays.\nDuring the execution of read_args(), the routine processes arguments supplied by a remote sender. The vulnerability manifests when the argument count causes the argv heap allocation to be exactly full. Upon inserting the final elements, the code attempts to write the trailing NULL terminator. Because the allocation boundary was sized strictly to the argument count without factoring in the terminating element offset, the NULL byte is written exactly one slot beyond the allocated heap buffer boundary.\nThis out-of-bounds write corrupts adjacent heap memory metadata or neighboring heap chunks. Depending on the precise heap layout managed by the memory allocator at the time of execution, this corruption can trigger immediate segmentation faults resulting in a denial of service, or alter adjacent data structures maintained on the heap.\nThe attack flow proceeds as follows: 1) A malicious sender establishes a connection with a vulnerable rsync instance. 2) The sender transmits a crafted argument list designed to trigger the precise boundary condition in read_args(). 3) The vulnerable component allocates the argv array on the heap based on the manipulated argument count. 4) As arguments are parsed and stored, the function writes the trailing NULL terminator one slot past the allocated buffer boundary. 5) Adjacent heap memory is corrupted, leading to anomalous application behavior or crash.\nPrerequisites for exploitation include network exposure to a malicious rsync sender capable of initiating the argument exchange processed by read_args(). Authentication and privilege requirements depend on the specific deployment context of the rsync daemon or shell-based invocation, but untrusted remote senders interacting with exposed services represent the primary threat vector."
}