An out-of-bounds read exists in the sender-side block matching logic. A malicious receiver can trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. This causes a negative offset calculation during delta computation, leading to an out-of-bounds read of file data buffer memory on the sender side.