CVE-2026-53798

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A privilege confusion issue exists in the name-converter subprocess uid/gid mapping. Local attackers can cause transferred files to be owned by root by influencing the name-converter responses to return empty values. When the subprocess returns an empty response for a uid or gid lookup, the software incorrectly interprets this as a successful resolution to uid/gid 0 (root) instead of a lookup failure. If the name-converter also signals fake super-user status, root ownership is assigned to the transferred files.

Recommendations Update to version 3.5.0 or later.