Skip to content
Fencer Vulns
medium 4.3

CVE-2025-10158 json

Rsync: Out of bounds array access via negative index

published 2025-11-18 11 mo ago modified 2026-10-19 20 d ago also EUVD-2025-198005 , GHSA-3rvc-qcwh-fhqv , JLSEC-2026-625

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The

malicious

rsync client requires at least read access to the remote rsync module in order to trigger the issue.

Patch / fix

  • julia rsync_jll 3.4.4+0
  • rsync Debian 12 3.2.7-1+deb12u4
  • rsync Debian 13 3.4.1+ds1-5+deb13u1
  • rsync Debian 14 3.4.1+ds1-7

debian advisories DEBIAN-CVE-2025-10158

  • rsync Ubuntu 22.04 LTS 3.2.7-0ubuntu0.22.04.6
  • rsync Ubuntu 24.04 LTS 3.2.7-1ubuntu1.4
  • rsync Ubuntu 25.10 3.4.1+ds1-5ubuntu1.2
  • rsync Ubuntu 26.04 LTS 3.4.1+ds1-7
  • rsync Ubuntu Pro 14.04 LTS 3.1.0-2ubuntu0.4+esm3
  • rsync Ubuntu Pro 16.04 LTS 3.1.1-3ubuntu1.3+esm5
  • rsync Ubuntu Pro 18.04 LTS 3.1.2-2.1ubuntu1.6+esm3
  • rsync Ubuntu Pro 20.04 LTS 3.1.3-8ubuntu0.9+esm1

ubuntu advisories UBUNTU-CVE-2025-10158

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsync RHEL 10.1 3.4.1-2.el10_1.2
  • rsync-daemon RHEL 10.1 3.4.1-2.el10_1.2
  • rsync-rrsync RHEL 10.1 3.4.1-2.el10_1.2
  • rsync RHEL 8 3.1.3-24.el8_10
  • rsync-daemon RHEL 8 3.1.3-24.el8_10
  • rsync RHEL 9 3.2.5-3.el9_7.2
  • rsync-daemon RHEL 9 3.2.5-3.el9_7.2
  • rsync-rrsync RHEL 9 3.2.5-3.el9_7.2

red hat advisories RHSA-2026:20696RHSA-2026:20604RHSA-2026:20602RHSA-2026:20603RHSA-2026:6825RHSA-2026:6436

  • rsync SLES for SAP applications 16.0, SLES 16.0 3.4.1-160000.4.1
  • rsync Linux Micro 6.0 3.2.7-5.1
  • rsync SLE Micro 5.2 3.2.3-150000.4.39.1
  • rsync SLE Micro 5.5, SLE Micro 5.4, SLE Micro 5.3 3.2.3-150400.3.26.1
  • rsync Linux Micro 6.1 3.3.0-slfo.1.1_4.1
  • rsync SLE Module for Basesystem 15 SP7, openSUSE Leap 15.6 3.2.7-150600.3.14.1
  • rsync SLES LTSS Extended Security 12 SP5 3.1.3-3.34.1

suse advisories SUSE-SU-2026:22015-1SUSE-SU-2026:20044-1SUSE-SU-2026:0069-1SUSE-SU-2026:0041-1SUSE-SU-2026:0005-1SUSE-SU-2026:20058-1

  • rsync openSUSE Tumbleweed 3.4.1-4.1

opensuse advisories openSUSE-SU-2025:15827-1

  • rsync-daemon AlmaLinux 10 3.4.1-2.el10_1.2
  • rsync-rrsync AlmaLinux 10 3.4.1-2.el10_1.2
  • rsync AlmaLinux 8 3.1.3-24.el8_10
  • rsync-daemon AlmaLinux 8 3.1.3-24.el8_10
  • rsync AlmaLinux 9 3.2.5-3.el9_7.2
  • rsync-daemon AlmaLinux 9 3.2.5-3.el9_7.2
  • rsync-rrsync AlmaLinux 9 3.2.5-3.el9_7.2

almalinux advisories ALSA-2026:6825ALSA-2026:6436ALSA-2026:6390

  • rsync Rocky Linux 10 3.4.1-2.el10_1.2
  • rsync Rocky Linux 8 3.1.3-24.el8_10
  • rsync Rocky Linux 9 3.2.5-3.el9_7.2

rocky linux advisories RLSA-2026:6825RLSA-2026:6436RLSA-2026:6390

  • rsync Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 3.4.1-r1

alpine advisories ALPINE-CVE-2025-10158

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsync CBL-Mariner 2.0, Azure Linux 3.0 3.4.1-2

azure linux advisories AZL-70387AZL-70667

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-10158 updated cvss 4.3

rsync: Rsync: Out of bounds array access via negative index

  • Red Hat Enterprise Linux 6 rsync Red Hat Enterprise Linux 7 rsync
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Middleware Containers for OpenShift rhpam-7/rhpam-kieserver-rhel8 7.13.5-4.1777325709, rhpam-7/rhpam-controller-rhel8 7.13.5-4.1777325710, rhpam-7/rhpam-dashbuilder-rhel8 7.13.5-3.1777325680, rhpam-7/rhpam-smartrouter-rhel8 7.13.5-4.1777325708, rhpam-7/rhpam-businesscentral-rhel8 7.13.5-4.1777325711, rhpam-7/rhpam-process-migration-rhel8 7.13.5-4.1777325680, +1 more
    fixed: vendor fix RHSA-2026:13812
  • Red Hat Enterprise Linux AppStream (v. 9) rsync-daemon 3.2.5-3.el9_7.2, rsync-rrsync 3.2.5-3.el9_7.2
    fixed: vendor fix RHSA-2026:6390
  • Red Hat Enterprise Linux AppStream (v. 10) rsync-daemon 3.4.1-2.el10_1.2, rsync-rrsync 3.4.1-2.el10_1.2
    fixed: vendor fix RHSA-2026:6825
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) rsync-daemon 3.2.3-19.el9_2.3
    fixed: vendor fix RHSA-2026:20602
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rsync-daemon 3.4.1-2.el10_0.2
    fixed: vendor fix RHSA-2026:20696
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rsync-daemon 3.2.3-19.el9_4.3
    fixed: vendor fix RHSA-2026:20604
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rsync-daemon 3.2.5-3.el9_6.1
    fixed: vendor fix RHSA-2026:20603
show 8 more
  • Red Hat Enterprise Linux BaseOS (v. 8) rsync 3.1.3-24.el8_10, rsync-daemon 3.1.3-24.el8_10
    fixed: vendor fix RHSA-2026:6436
  • Red Hat Enterprise Linux BaseOS (v. 9) rsync 3.2.5-3.el9_7.2
    fixed: vendor fix RHSA-2026:6390
  • Red Hat Enterprise Linux BaseOS (v. 10) rsync 3.4.1-2.el10_1.2
    fixed: vendor fix RHSA-2026:6825
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) rsync 3.2.3-19.el9_2.3
    fixed: vendor fix RHSA-2026:20602
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) rsync 3.4.1-2.el10_0.2
    fixed: vendor fix RHSA-2026:20696
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) rsync 3.2.3-19.el9_4.3
    fixed: vendor fix RHSA-2026:20604
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) rsync 3.2.5-3.el9_6.1
    fixed: vendor fix RHSA-2026:20603
  • Red Hat Middleware Containers for OpenShift rhpam-7/rhpam-operator-bundle 7.13.5-40 Red Hat Enterprise Linux AppStream EUS (v. 10.0) rsync-rrsync 3.4.1-2.el10_0.2 Red Hat Enterprise Linux AppStream EUS (v.9.6) rsync-rrsync 3.2.5-3.el9_6.1 Red Hat Enterprise Linux BaseOS E4S (v.9.2) rsync-debuginfo 3.2.3-19.el9_2.3, rsync-debugsource 3.2.3-19.el9_2.3 Red Hat Enterprise Linux BaseOS EUS (v. 10.0) rsync-debuginfo 3.4.1-2.el10_0.2, rsync-debugsource 3.4.1-2.el10_0.2 Red Hat Enterprise Linux BaseOS EUS (v.9.4) rsync-debuginfo 3.2.3-19.el9_4.3, rsync-debugsource 3.2.3-19.el9_4.3
    +1 more products
    Red Hat Enterprise Linux BaseOS EUS (v.9.6) rsync-debuginfo 3.2.5-3.el9_6.1, rsync-debugsource 3.2.5-3.el9_6.1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11 mo ago

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
julia rsync_jll
<3.4.4+0
3.4.4+0

Affected products

  • rsync rsync

Classification

Weakness
  • CWE-129 Improper Validation of Array Index

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.