CVE-2025-10158
BaseFortify
Publication date: 2025-11-18
Last updated on: 2025-11-18
Assigner: Rapid7, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rsync | rsync | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-129 | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when a malicious rsync client, acting as the receiver in a file transfer, triggers an out of bounds read of a heap-based buffer by using a negative array index. To exploit this, the malicious client must have at least read access to the remote rsync module.
How can this vulnerability impact me? :
The vulnerability can lead to an out of bounds read, which may cause information disclosure or instability in the rsync service. However, it does not directly impact confidentiality or availability according to the CVSS score, but it can affect integrity to a limited extent.