The bug in rclone’s local backend allows a crafted HTTP Range header to trigger a slice‑bounds panic when a symlink target is translated, causing the request handler to crash. This results in a deterministic request‑level denial of service while keeping the main rclone process alive. The flaw stems from unchecked positive range starts and improper string slicing, which map to integer overflow or wraparound and out‑of‑bounds read weaknesses.

The vulnerability affects rclone releases older than 1.75.1 when the --links option or links=true is enabled, exposing symlink. It is exploitable through the HTTP or WebDAV interfaces of the backend/local component. Users running such versions and serving local files over these protocols are at risk.

With a CVSS score of 5.3 the issue carries a moderate risk profile. No EPSS data or CISA KEV listing is available, indicating no known widespread exploitation. The exploit vector is remote request over HTTP or WebDAV to provoke the panic. The impact is limited to the offending request, causing a denial of service for that connection.