CVE-2025-10158
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Nov 18, 2025
CISA due date
—
The record
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | rsync | 0 | 3.2.7-1.3.mga9 |
| SUSE:Linux Enterprise Micro 5.2 | rsync | 0 | 3.2.3-150000.4.39.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | rsync | 0 | 3.2.7-150600.3.14.1 |
| openSUSE:Leap 15.6 | rsync | 0 | 3.2.7-150600.3.14.1 |
| openSUSE:Tumbleweed | rsync | 0 | 3.4.1-4.1 |
Related vulnerabilities
- CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. Also affects rsync
- CVE-2024-12086 A flaw was found in rsync. Also affects rsync
- CVE-2024-12085 A flaw was found in rsync which could be triggered when rsync compares file checksums. Also affects rsync
- CVE-2024-12087 A path traversal vulnerability exists in rsync. Also affects rsync
- CVE-2024-12088 A flaw was found in rsync. Also affects rsync
- CVE-2024-12747 A flaw was found in rsync. Also affects rsync
- CVE-2026-29518 Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race… Also affects rsync
- CVE-2026-43620 Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read… Also affects rsync