Vulnerability · Published Nov 18, 2025 · Assigned by rapid7
CVE-2025-10158Rsync: Out of bounds array access via negative index
Medium 4.3
In plain English
A medium-severity security flaw in rsync from rsync. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 71.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | rsync | 3.1.3-24.el8_10 | ALSA-2026:6436 |
| AlmaLinux:9 | rsync | 3.2.5-3.el9_7.2 | ALSA-2026:6390 |
| AlmaLinux:10 | rsync-daemon | 3.4.1-2.el10_1.2 | ALSA-2026:6825 |
| AlmaLinux:8 | rsync-daemon | 3.1.3-24.el8_10 | ALSA-2026:6436 |
| AlmaLinux:9 | rsync-daemon | 3.2.5-3.el9_7.2 | ALSA-2026:6390 |
| AlmaLinux:10 | rsync-rrsync | 3.4.1-2.el10_1.2 | ALSA-2026:6825 |
| AlmaLinux:9 | rsync-rrsync | 3.2.5-3.el9_7.2 | ALSA-2026:6390 |
| Alpine:v3.20 | rsync | 3.4.1-r1 | ALPINE-CVE-2025-10158 |
| Alpine:v3.21 | rsync | 3.4.1-r1 | ALPINE-CVE-2025-10158 |
| Alpine:v3.22 | rsync | 3.4.1-r1 | ALPINE-CVE-2025-10158 |
| Alpine:v3.23 | rsync | 3.4.1-r1 | ALPINE-CVE-2025-10158 |
| Alpine:v3.24 | rsync | 3.4.1-r1 | ALPINE-CVE-2025-10158 |
| Debian:12 | rsync | 3.2.7-1+deb12u4 | DEBIAN-CVE-2025-10158 |
| Debian:13 | rsync | 3.4.1+ds1-5+deb13u1 | DEBIAN-CVE-2025-10158 |
| Debian:14 | rsync | 3.4.1+ds1-7 | DEBIAN-CVE-2025-10158 |
| Rocky Linux:10 | rsync | 0:3.4.1-2.el10_1.2 | RLSA-2026:6825 |
| Rocky Linux:8 | rsync | 0:3.1.3-24.el8_10 | RLSA-2026:6436 |
| Rocky Linux:9 | rsync | 0:3.2.5-3.el9_7.2 | RLSA-2026:6390 |
| Ubuntu:22.04:LTS | rsync | 3.2.7-0ubuntu0.22.04.6 | UBUNTU-CVE-2025-10158 |
| Ubuntu:24.04:LTS | rsync | 3.2.7-1ubuntu1.4 | UBUNTU-CVE-2025-10158 |
| Ubuntu:25.10 | rsync | 3.4.1+ds1-5ubuntu1.2 | UBUNTU-CVE-2025-10158 |
| Ubuntu:26.04:LTS | rsync | 3.4.1+ds1-7 | UBUNTU-CVE-2025-10158 |
Affected products (as reported)
Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N