CVE-2025-10158 Rsync: Out of bounds array access via negative index
A malicious rsync client can trigger an out-of-bounds heap read via a negative index, potentially causing information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-10158?
CVE-2025-10158 is a medium-severity memory corruption vulnerability in rsync, published on 18 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
Weakness: CWE-129
Which versions are affected by CVE-2025-10158?
Linux distribution packages (34)
rsync-daemon AlmaLinux:10 | All versions | 3.4.1-2.el10_1.2 |
rsync-rrsync AlmaLinux:10 | All versions | 3.4.1-2.el10_1.2 |
rsync AlmaLinux:8 | All versions | 3.1.3-24.el8_10 |
rsync-daemon AlmaLinux:8 | All versions | 3.1.3-24.el8_10 |
rsync AlmaLinux:9 | All versions | 3.2.5-3.el9_7.2 |
rsync-daemon AlmaLinux:9 | All versions | 3.2.5-3.el9_7.2 |
rsync-rrsync AlmaLinux:9 | All versions | 3.2.5-3.el9_7.2 |
rsync Red Hat:enterprise_linux:10.1 | All versions | 0:3.4.1-2.el10_1.2 |
rsync-daemon Red Hat:enterprise_linux:10.1 | All versions | 0:3.4.1-2.el10_1.2 |
rsync-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.4.1-2.el10_1.2 |
rsync-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.4.1-2.el10_1.2 |
rsync-rrsync Red Hat:enterprise_linux:10.1 | All versions | 0:3.4.1-2.el10_1.2 |
rsync Red Hat:enterprise_linux:8::baseos | All versions | 0:3.1.3-24.el8_10 |
rsync-daemon Red Hat:enterprise_linux:8::baseos | All versions | 0:3.1.3-24.el8_10 |
rsync-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.1.3-24.el8_10 |
rsync-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:3.1.3-24.el8_10 |
rsync-daemon Red Hat:enterprise_linux:9::appstream | All versions | 0:3.2.5-3.el9_7.2 |
rsync-rrsync Red Hat:enterprise_linux:9::appstream | All versions | 0:3.2.5-3.el9_7.2 |
rsync Red Hat:enterprise_linux:9::baseos | All versions | 0:3.2.5-3.el9_7.2 |
rsync-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.2.5-3.el9_7.2 |
rsync-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:3.2.5-3.el9_7.2 |
rsync Rocky Linux:10 | All versions | 0:3.4.1-2.el10_1.2 |
rsync Rocky Linux:8 | All versions | 0:3.1.3-24.el8_10 |
rsync Rocky Linux:9 | All versions | 0:3.2.5-3.el9_7.2 |
rsync SUSE:Linux Enterprise Micro 5.2 | All versions | 3.2.3-150000.4.39.1 |
rsync SUSE:Linux Enterprise Micro 5.3 | All versions | 3.2.3-150400.3.26.1 |
rsync SUSE:Linux Enterprise Micro 5.4 | All versions | 3.2.3-150400.3.26.1 |
rsync SUSE:Linux Enterprise Micro 5.5 | All versions | 3.2.3-150400.3.26.1 |
rsync SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.2.7-150600.3.14.1 |
rsync SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.1.3-3.34.1 |
rsync SUSE:Linux Micro 6.0 | All versions | 3.2.7-5.1 |
rsync SUSE:Linux Micro 6.1 | All versions | 3.3.0-slfo.1.1_4.1 |
rsync openSUSE:Leap 15.6 | All versions | 3.2.7-150600.3.14.1 |
rsync openSUSE:Tumbleweed | All versions | 3.4.1-4.1 |
How do I fix CVE-2025-10158?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-10158 being exploited?
There is no known exploitation of CVE-2025-10158 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-10158, ALSA-2026:6390, ALSA-2026:6436, ALSA-2026:6825, AZL-70387, AZL-70667 and 27 more.