CVE-2026-53792

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description An out-of-bounds read exists in the sender-side block matching logic. A malicious receiver can trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. This causes a negative offset calculation during delta computation, leading to an out-of-bounds read of file data buffer memory on the sender side.

Recommendations Update rsync to version 3.5.0 or later.