rsync before version 3.5.0 contains a privilege confusion vulnerability in the name‑converter subprocess uid/gid mapping. The flaw allows local attackers to cause transferred files to be owned by root by influencing name‑converter responses to return empty values. When the name‑converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) instead of a lookup failure, and if the name‑converter also signals fake super‑user status, rsync proceeds with root ownership assignments for transferred files. This can give an attacker effectively root ownership on the host for files produced by rsync.

The vulnerability affects all installations of rsync from the RsyncProject project where the software version is less than 3.5.0. No specific operating systems are mentioned in the advisory, so any system running rsync before 3.5.0 is potentially impacted.

The CVSS score of 6.9 indicates a moderate severity. Because the attack requires local access to influence the name‑converter subprocess, the threat is limited to local attackers; network or remote exploitation is not documented. The EPSS score is < 1% (0.00278), indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, if an attacker can run rsync locally or influence name‑converter, they can assign root ownership to transferred files, which could be leveraged for further local privilege escalation or persistence.