Out-of-Bounds Read Vulnerability in rsync by Rsync Project

CVE-2026-53792

What is CVE-2026-53792?

The rsync software prior to version 3.5.0 is susceptible to an out-of-bounds read vulnerability stemming from flawed handling of checksum blocks during the synchronization process. This vulnerability allows an attacker to craft a malicious checksum block with a length of zero, leading to memory access before the beginning of an allocated buffer. When the sender attempts to process this crafted checksum, it causes negative offset calculations during delta computation, which ultimately results in unauthorized reading of file data buffer memory. This critical flaw poses significant risks by exposing sensitive data and potentially allowing further exploits.

References