rsync, versions 3.0.0 through 3.4.x, includes an out‑of‑bounds write that can corrupt memory when a file entry is processed with the FLAG_HLINKED flag while hard‑link preservation is disabled. The flaw arises from missing the F_SUM field in the file_struct layout, allowing an attacker to write beyond the allocated buffer. Such memory corruption can overwrite adjacent heap or stack data, potentially enabling arbitrary code execution or denial of service, depending on how the overwritten data is used by rsync or the operating system.

The vulnerability affects rsync provided by RsyncProject, specifically any release starting at rsync 3.0.0 up to but not including 3.5.0. Users running these versions on any platform where rsync services are exposed to untrusted clients are at risk.

The CVSS score of 8.8 classifies this issue as a high‑severity vulnerability. EPSS data is unavailable so a precise exploitation probability cannot be quantified; however, rsync is commonly used for remote file synchronization, suggesting that an attacker could target the service over the network. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation would require sending a crafted sync request that triggers HLINK_BUMP processing on a file with FLAG_HLINKED set and hard‑link preservation disabled, thereby overflowing the file_struct and corrupting memory.