Description

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T15:20:00.117Z",
  "pubdate": "2026-08-13T15:20:00.117Z",
  "executiveSummary": "This vulnerability is a heap out-of-bounds write affecting the rsync utility. The flaw allows remote unauthenticated attackers to write a single attacker-controlled byte past the allocated boundary of a heap buffer. The issue is triggered by supplying a specifically crafted files-from entry to an rsync daemon, including configurations running read-only modules. The primary impact involves memory corruption, which under specific heap layout conditions could potentially lead to arbitrary code execution or denial of service conditions. Exploitation requires no prior authentication and can be executed remotely against exposed rsync services accepting files-from arguments. The attack vector relies on input manipulation that induces an arithmetic error during buffer sizing calculations.",
  "technicalDetails": "The vulnerability resides in the buffer allocation and string parsing logic within the add_implied_include() function of rsync. The root cause of the heap out-of-bounds write is an integer or sizing miscalculation that occurs when processing path strings containing escape sequences or backslashes. Specifically, when an attacker supplies a files-from entry containing both an interior backslash and a trailing backslash, the add_implied_include() function incorrectly counts or under-counts the trailing backslash. Because the sizing logic allocates a destination buffer that is too small by one byte to accommodate the fully parsed and processed string, the subsequent memory copy operation writes a single attacker-controlled byte out-of-bounds past the end of the heap allocation. The affected component is the files-from parsing and implied include handling mechanism within rsync versions 3.2.5 prior to 3.5.0. Exploitation requires network access to a vulnerable rsync daemon, and the attack can be successfully mounted even against read-only rsync modules because the vulnerability is triggered during the initial parsing of the file list rather than during write operations to the filesystem. The attack flow proceeds as follows: First, the remote unauthenticated attacker connects to the rsync daemon over the network. Second, the attacker transmits a crafted files-from list containing the precise combination of interior and trailing backslashes. Third, the rsync daemon invokes add_implied_include() to process the entry, resulting in an under-sized heap buffer allocation. Fourth, the parsing routine copies data into the destination buffer, causing a one-byte heap out-of-bounds write. Post-exploitation impact depends heavily on heap layout determinism, potentially leading to application crashes, heap metadata corruption, or memory corruption vulnerabilities that an advanced adversary could leverage."
}