CVE-2026-53792

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw
https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block

Configurations

No configuration.

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) rsync anterior a la versión 3.5.0 contiene una vulnerabilidad de lectura fuera de límites en la lógica de coincidencia de bloques del lado del remitente que permite a un receptor malicioso activar el acceso a la memoria antes del inicio de un búfer asignado al enviar un bloque de suma de verificación manipulado con una longitud de cero. Los atacantes pueden enviar un conjunto de suma de verificación especialmente manipulado que contiene un bloque de longitud cero para causar un cálculo de desplazamiento negativo durante la computación delta, lo que resulta en una lectura fuera de límites de la memoria del búfer de datos del archivo en el lado del remitente.

Information

Published : 2026-08-13 15:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-53792

Mitre link : CVE-2026-53792

CVE.ORG link : CVE-2026-53792

JSON object : View

Products Affected

No product.

CWE

CWE-129

Improper Validation of Array Index

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-53792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53792", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T15:55:27.241485Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "RsyncProject", "product": "rsync", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.4"}, {"status": "unaffected", "version": "3.5.0", "versionType": "semver"}], "collectionURL": "https://github.com/RsyncProject/rsync", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T15:19:43.527", "references": [{"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-129"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "rsync\u00a0before 3.5.0\u00a0contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side."}, {"lang": "es", "value": "rsync anterior a la versi\u00f3n 3.5.0 contiene una vulnerabilidad de lectura fuera de l\u00edmites en la l\u00f3gica de coincidencia de bloques del lado del remitente que permite a un receptor malicioso activar el acceso a la memoria antes del inicio de un b\u00fafer asignado al enviar un bloque de suma de verificaci\u00f3n manipulado con una longitud de cero. Los atacantes pueden enviar un conjunto de suma de verificaci\u00f3n especialmente manipulado que contiene un bloque de longitud cero para causar un c\u00e1lculo de desplazamiento negativo durante la computaci\u00f3n delta, lo que resulta en una lectura fuera de l\u00edmites de la memoria del b\u00fafer de datos del archivo en el lado del remitente."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}