Description

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T15:19:59.490Z",
  "pubdate": "2026-08-13T15:19:59.490Z",
  "executiveSummary": "An out-of-bounds write vulnerability exists in rsync versions 3.2.3 prior to 3.5.0, specifically within the parse_size_arg() function. The flaw arises from the improper handling of the return value of snprintf() when formatting size arguments, which is subsequently used directly as an index into a .bss-segment array without adequate bounds checking.\nWhen snprintf() encounters string truncation, its return value reflects the total number of characters that would have been written had the buffer been sufficiently large, rather than the actual number of bytes written. This oversized return value can exceed the allocated length of the target array, causing a subsequent indexed write operation to target memory outside the intended buffer boundaries.\nThe primary impact of this vulnerability is the corruption of .bss memory, which may lead to application instability, denial of service, or potentially arbitrary code execution depending on the adjacent memory layout and execution context. The vulnerability affects rsync deployments utilizing vulnerable versions parsing maliciously crafted size arguments. Exploitation typically requires an attacker to supply specially formulated input that triggers the size formatting logic, resulting in buffer truncation and subsequent memory corruption within the global data segment.",
  "technicalDetails": "The vulnerability resides in the parse_size_arg() function within rsync, specifically affecting versions 3.2.3 up to 3.5.0. The vulnerable component processes size arguments by formatting them using the standard library function snprintf().\nThe root cause of the vulnerability is the unsafe assumption regarding the return value semantics of snprintf() and the complete absence of bounds checking before using this return value as an array index. According to standard C specifications, snprintf() returns the total number of characters that would have been written to the string if the size had been unlimited, excluding the terminating null byte. If the resulting formatted string exceeds the destination buffer size, the return value will be greater than or equal to the size argument passed to the function, indicating truncation.\nIn the vulnerable implementation, the return value of snprintf() is taken directly and utilized as an index into an array located in the .bss data segment. Because no validation or clamping is performed to ensure the index falls within the allocated bounds of the .bss-segment array, a sufficiently large return value resulting from string truncation bypasses safety checks.\nThe attack flow proceeds as follows: 1) An attacker supplies a malicious or excessively large size argument to rsync that is processed by parse_size_arg(). 2) The application invokes snprintf() to format the size string into a fixed-size internal buffer. 3) The formatting operation truncates the output, causing snprintf() to return an integer value representing the full length of the intended output, which exceeds the physical size of the buffer and the dimensions of the corresponding .bss-segment array. 4) The application takes this out-of-range return value and uses it directly as an index for a subsequent write operation. 5) The indexed write targets memory addresses outside the legitimate boundaries of the array, resulting in the corruption of adjacent variables and data structures residing within the .bss segment.\nThe post-exploitation impact includes unintended state modification, application crashes leading to denial of service, and potential control flow hijacking if critical function pointers or application variables stored in the .bss segment are overwritten. Authentication, privilege requirements, and network exposure depend entirely on the specific execution vector through which parse_size_arg() receives untrusted input within the rsync architecture."
}