This vulnerability involves improper handling of length parameter inconsistency (CWE-130) in the Samba rsync utility. Specifically, the receive_xattr function relies on an untrusted length value during a qsort operation, leading to a use-after-free condition on the receiver side. This can be triggered when rsync is run with the -X option to handle extended attributes. The affected versions are from 3.0.1 through 3.4.1. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to cause a use-after-free on the victim's system running rsync with extended attributes enabled, potentially leading to arbitrary code execution or denial of service. The vulnerability affects many Linux configurations and is more widespread on non-Linux platforms. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running rsync with the -X or --xattrs option on affected versions. Monitor vendor communications for updates and apply patches promptly once available.