A memory corruption flaw exists in rsync versions 3.2.3 through 3.4.x where the function parse_size_arg() uses the return value of snprintf() directly as an index into a .bss‑segment array without validating bounds. When snprintf truncates the formatted size string, its return value represents the total number of characters that would have been written, including truncated data, and this value can exceed the array length. The resulting out‑of‑bounds write corrupts memory beyond the intended buffer, potentially leading to arbitrary code execution or denial of service.

The vulnerability affects the rsync project’s rsync software, specifically all releases from 3.2.3 up to, but not including, 3.5.0. Users running any of these affected versions are at risk and should upgrade to ≥3.5.0.

The CVSS score of 8.3 reflects a high severity risk with strong impact potential. EPSS data is not available, but the flaw is not listed in CISA’s KEV catalog, indicating it is not currently known to have widespread exploitation. The likely attack vector is a remote attacker who can connect to a running rsync process and send size arguments that trigger the buffer overflow, giving the attacker the ability to overwrite memory and potentially execute arbitrary code. Discovery of an exploit path therefore underscores the need for timely remediation.