A heap out‑of‑bounds write exists in rsync versions prior to 3.5.0. By including a specially crafted files‑from entry that contains both an interior and a trailing backslash, a remote unauthenticated attacker can cause the add_implied_include() function to miscount the buffer size and write one byte past the end of a heap allocation. This allows the attacker to corrupt arbitrary memory, potentially leading to arbitrary code execution or other severe integrity compromises.

The vulnerability affects includes the rsync project’s rsync daemon. All releases from 3.2.5 up through 3.4.x are vulnerable. Version 3.5.0 and later contain the fix and are safe.

The CVSS score of 8.8 classifies this as a high‑severity flaw. Although the EPSS score is not provided, the vulnerability is not currently listed in CISA KEV, suggesting no confirmed exploit at this time. The attack vector requires only a crafted files‑from entry and does not need authentication, making it easy to trigger against any exposed rsync daemon that accepts such entries. If the attacker succeeds in corrupting memory, the impact could be full system compromise.