Description

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T15:19:59.663Z",
  "pubdate": "2026-08-13T15:19:59.663Z",
  "executiveSummary": "An out-of-bounds write vulnerability exists in rsync versions 3.0.0 before 3.5.0, allowing potential memory corruption.\nThe vulnerability is triggered during HLINK_BUMP processing when file entries contain the FLAG_HLINKED flag while the hard-link preservation option is inactive.\nThe root cause stems from the missing F_SUM field within the file_struct layout, which leads to unauthorized access of memory past the allocated structure boundary.\nSuccessful exploitation enables attackers to corrupt adjacent heap or stack data, potentially leading to arbitrary memory modification or application instability.\nAttackers require the ability to supply or influence file list data processed by rsync to trigger the erroneous flag state and subsequent out-of-bounds write condition.",
  "technicalDetails": "The vulnerability resides in the file list handling and hard-link processing logic of rsync versions 3.0.0 through 3.4.x.\nThe root cause is a layout discrepancy in the file_struct data structure when the hard-link preservation option is explicitly inactive, resulting in the absence of the expected F_SUM field.\nDuring execution, if an attacker provides file entries possessing the FLAG_HLINKED flag while hard-link preservation remains disabled, the application improperly initiates HLINK_BUMP processing.\nBecause the F_SUM field is omitted from the file_struct layout under these specific operational conditions, pointer arithmetic and offset calculations during HLINK_BUMP evaluation miscalculate structure boundaries.\nThis calculation error causes the execution context to read or write past the end of the dynamically allocated memory region assigned to the file_struct instance.\nConsequently, the out-of-bounds write primitive corrupts adjacent memory blocks residing on the heap or stack, depending on allocation patterns.\nDepending on the corrupted memory layout, this condition can cause application crashes, denial of service, or potentially more severe memory integrity compromises if sensitive control data or pointers are overwritten."
}