rsync versions 3.0.1 through 3.4.x contain a heap out‑of‑bounds write in the read_args() function. A malicious sender can craft an argument list that causes the argv allocation to be exactly full, so the terminating NULL is written one slot past the boundary. This corrupts adjacent heap memory, potentially allowing an attacker to alter program state, crash the daemon, or execute arbitrary code. The flaw is a classic CWE‑787 vulnerability.

The vulnerability affects rsync supplied by the RsyncProject for all releases that are older than 3.5.0, including rsync 3.0.1, 3.1.x, 3.2.x, 3.3.x, and 3.4.x.

The CVSS score of 8.8 indicates a high‑severity weakness. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. The flaw is reachable from the network side; a threat actor who can establish a connection to the rsync daemon as a sender can deliver the crafted arguments. If successfully exploited, the heap corruption could lead to remote code execution or denial of service.