The vulnerability resides in rclone’s SquashFS parser within the archive backend. The parser does not validate attacker‑controlled superblock and metadata values before use, enabling malicious images to trigger integer division‑by‑zero panics, out‑of‑bounds slice panics, or a sustained CPU loop. When these faults occur the rclone process terminates, and if rclone is being used to serve SFTP, the entire SFTP server can crash. The impact is a loss of service availability for clients interacting with the affected archive.

All rclone installations using versions v1.72.0 through v1.74.4 inclusive are affected. The vendor is rclone, and the issue lies specifically in the :archive: backend handling of SquashFS images. Versions v1.75.0 and later contain the fix.

The CVSS score of 7.1 indicates a severe availability impact. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to place or modify a SquashFS image in a storage location that is exposed through an rclone :archive: remote. Since the parser operates lazily, a remote client or any process that enumerates or accesses the malicious archive object must trigger the fault. The likely attack vector is remote or local access to the archive remote; it can also be triggered through an SFTP session if rclone is serving SFTP.