CVE-2026-53792

A flaw was found in rsync. A malicious receiver can exploit an out-of-bounds read vulnerability in the sender-side block matching logic. By sending a specially crafted checksum block with a length of zero, an attacker can trigger memory access before the start of an allocated buffer. This can lea...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the sender-side block matching process. An attacker can cause memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero, resulting in an...

EUVD-2026-58100

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

CVE-2026-53792

rsync prior to 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic. A zero-length checksum block can cause a negative offset during delta computation, leading to an out-of-bounds read of sender-side file data. Affected: rsync

CVE-2026-53792: Improper Validation of Array Index

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...