CVE-2025-10158 — Rsync: Out of bounds array access via negative index
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync…
Published: 2025-11-18 · CVSS: 4.3 · CVSS 3.1
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7