A newline injection flaw exists in rsync versions before 3.5.0 within the name‐converter uid/gid mapping interface. The vulnerability lets a local attacker embed newline characters into user or group names, causing the daemon to treat forged messages as legitimate protocol input. This corrupts the uid/gid mapping logic, potentially granting the attacker elevated access or allowing the manipulation of file ownership on the target system.

The problem affects the rsync package provided by RsyncProject when installed at any version earlier than 3.5.0. No specific build or platform constraints are stated, so all operating systems running those releases are potentially impacted.

The CVSS score of 6.9 indicates moderate risk. The EPSS score is not available, so the current likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation has been reported. Exploitation requires local access and the attacker must be able to control user or group names passed to rsync. Once the injection succeeds, the daemon can misinterpret protocol messages, leading to privilege escalation or data corruption.