rsync before version 3.5.0 contains a privilege confusion vulnerability in the name‑converter subprocess uid/gid mapping. When the name‑converter returns empty responses for a uid or gid lookup, rsync incorrectly interprets this as a successful resolution to uid/gid 0 (root) and, if the name‑converter also signals fake super‑user status, rsync assigns root ownership to transferred files. This flaw allows a local attacker to cause files copied by rsync to be owned by root, effectively granting elevated privileges for those files.

The vulnerability affects all installations of rsync from the RsyncProject project where the software version is less than 3.5.0. No specific operating systems are mentioned in the advisory, so any system running rsync before 3.5.0 is potentially impacted.

The CVSS score of 6.9 indicates a moderate severity. Because the attack requires local access to influence the name‑converter subprocess, the threat is limited to local attackers; network or remote exploitation is not documented. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, if an attacker can run rsync locally or influence the name‑converter, they can assign root ownership to transferred files, which could be leveraged for further local privilege escalation or persistence.