CVE-2025-10158: Rsync Buffer Overflow Vulnerability

CVE-2025-10158 Overview

CVE-2025-10158 is an out-of-bounds read vulnerability in rsync, the widely deployed file synchronization utility. A malicious rsync client acting as the receiver of a file transfer can trigger an out-of-bounds read of a heap-based buffer through a negative array index. The flaw is categorized under [CWE-129: Improper Validation of Array Index].

Exploitation requires the attacker to have at least read access to the targeted remote rsync module. The vulnerability stems from insufficient bounds checking when the sender process indexes into the cur_flist->files array using an attacker-influenced file index value.

Critical Impact
An authenticated malicious rsync client can read out-of-bounds heap memory on the server, potentially leaking sensitive process memory or causing abnormal termination of the rsync service.

Affected Products

Rsync file transfer utility (open-source project maintained by the Rsync Project)
Linux and Unix distributions bundling vulnerable rsync versions
Backup appliances and NAS devices that embed rsync for remote synchronization

Discovery Timeline

2025-11-18 - CVE-2025-10158 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10158

Vulnerability Analysis

The vulnerability resides in sender.c, the rsync source file responsible for sending file data to a receiver. During a transfer, the sender resolves a file index (ndx) received from the client into an entry inside the current file list structure (cur_flist). When the computed offset ndx - cur_flist->ndx_start is non-negative, rsync indexes directly into cur_flist->files. When the offset is negative, the original code falls back to dir_flist->files[cur_flist->parent_ndx] without validating that parent_ndx is a valid, non-negative index.

A malicious client can craft protocol messages that cause parent_ndx to be negative. The sender then dereferences dir_flist->files at a negative offset, producing a heap-based out-of-bounds read. The exposed memory may be sent back to the attacker as part of the file transfer response or cause rsync to crash.

Root Cause

The root cause is missing validation of the parent_ndx field before it is used as an array subscript. Rsync assumed parent_ndx would always point to a valid parent entry when ndx - cur_flist->ndx_start was negative. A malicious receiver can violate that assumption by manipulating the file list protocol state.

Attack Vector

The attack is network-based and requires low privileges, specifically read access to a remote rsync module. An attacker connects to an exposed rsyncd service, authenticates against a readable module, and initiates a transfer that steers the sender into the vulnerable code path. No user interaction is required on the server side.

// Patch excerpt from sender.c — adds validation of parent_ndx
		if (ndx - cur_flist->ndx_start >= 0)
			file = cur_flist->files[ndx - cur_flist->ndx_start];
+		else if (cur_flist->parent_ndx < 0)
+			exit_cleanup(RERR_PROTOCOL);
		else
			file = dir_flist->files[cur_flist->parent_ndx];
		if (F_PATHNAME(file)) {

Source: GitHub Rsync Commit 797e17f. The fix adds an explicit check that aborts the session with a protocol error (RERR_PROTOCOL) when parent_ndx is negative, preventing the out-of-bounds dereference.

Detection Methods for CVE-2025-10158

Indicators of Compromise

Unexpected rsyncd process crashes or restarts logged in syslog or journald with signals such as SIGSEGV
Protocol error messages from rsync referencing RERR_PROTOCOL or abnormal file list indices on patched hosts
Repeated authenticated sessions from a single client against readable rsync modules followed by malformed transfers

Detection Strategies

Enable verbose logging in rsyncd.conf (log file, transfer logging = yes) and alert on sessions that terminate abnormally mid-transfer
Monitor outbound data volumes from rsync modules for anomalous reads that do not correspond to legitimate file sizes
Correlate authentication events against rsync modules with subsequent process crashes to identify probing activity

Monitoring Recommendations

Track all hosts exposing TCP port 873 and inventory which modules permit anonymous or low-privilege read access
Ingest rsync daemon logs and host telemetry into a central analytics platform for cross-session correlation
Watch for repeated connections from the same source IP that trigger protocol errors after the patch is applied

How to Mitigate CVE-2025-10158

Immediate Actions Required

Update rsync to a version that includes commit 797e17fc4a6f15e3b1756538a9f812b63942686f or the vendor-backported fix
Restrict access to rsync modules so that only trusted, authenticated clients can connect
Disable any rsync modules that are not required for business operations, especially those exposed to untrusted networks

Patch Information

The upstream fix is available in the Rsync Project repository as commit 797e17fc4a6f15e3b1756538a9f812b63942686f. The patch adds a guard that terminates the session with RERR_PROTOCOL when cur_flist->parent_ndx is negative. Apply distribution-provided updates for packages such as rsync on Debian, Ubuntu, Red Hat Enterprise Linux, SUSE, and Alpine as they become available. Review the AttackerKB Assessment Report for ongoing exploitation context.

Workarounds

Place rsync daemons behind a VPN or IP allowlist so that only vetted clients can reach TCP port 873
Set read only = yes and strict auth users entries in rsyncd.conf to reduce the authenticated attack surface
Where possible, tunnel rsync over SSH and disable the standalone rsyncd service until the patch is deployed

bash

# Example hardened rsyncd.conf module definition
[backups]
    path = /srv/backups
    read only = yes
    auth users = backup-agent
    secrets file = /etc/rsyncd.secrets
    hosts allow = 10.0.0.0/24
    hosts deny = *