Out of Bound Read Vulnerability in Rsync File Transfer by Rsync Project

CVE-2025-10158

What is CVE-2025-10158?

A malicious client can exploit a flaw in the Rsync file transfer utility to induce an out of bounds read of a heap-based buffer, caused by the use of a negative array index. This vulnerability requires the malicious rsync client to have at least read access to the target remote rsync module, which can lead to potential information leakage or unauthorized access to sensitive data. It is crucial for users of rsync to apply security patches and stay informed on this vulnerability to mitigate risks.

References