rsync before version 3.5.0 contains an out‑of‑bounds read flaw in the sender side block matching logic that lets a malicious receiver trigger memory access before the start of an allocated buffer. By sending a crafted checksum set that includes a zero‑length block, the offset calculation during delta computation becomes negative, causing the sender to read data from an invalid memory area. The read is not restricted to the intended file data, so sensitive in‑memory information can be exposed to the attacker. This flaw is classified as an out‑of‑bounds read (CWE‑787) and improper index validation (CWE‑129).

The vulnerability affects the rsync project’s rsync application on all platforms where the affected binary is used. Specifically, any rsync installation with a version earlier than 3.5.0 is impacted, regardless of operating system. The issue resides in the core checksum and delta transfer code, so all default configurations that enable delta transfer are susceptible.

The CVSS score for this vulnerability is 7.1, indicating a high severity level. EPSS is not available, but the absence of a KEV listing suggests there have been no widely documented public exploits at the time of this analysis. Attackers need the ability to act as a rsync client against a running rsync service (usually port 873), meaning network access to the target system is required. Once connected, an attacker can send a specially crafted checksum block with a zero length; no local privileges are necessary. The impact is limited to information disclosure on the sender side, but the read of arbitrary memory could potentially lead to unexpected behavior or crashes, depending on the data accessed.