Vulnerability Description
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw
- https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-ch
FAQ
What is CVE-2026-53792?
CVE-2026-53792 is a vulnerability with a CVSS score of 6.5 (MEDIUM). rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffe...
How severe is CVE-2026-53792?
CVE-2026-53792 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53792?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.