Rsync versions up to 3.4.2 contain a receiver-side out-of-bounds array read vulnerability in the recv_files() function within receiver.c. The issue arises when the CF_INC_RECURSE compatibility flag is set and the server sends a file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word missing ITEM_TRANSFER. This causes the client to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped memory address, resulting in a deterministic crash (SIGSEGV) of the rsync client process. The vulnerability can be exploited remotely by a malicious rsync server without requiring privileges or user interaction beyond initiating the connection.

Successful exploitation results in a denial of service by crashing the rsync client process. There is no indication of code execution or data corruption beyond the crash. The vulnerability affects client-side rsync versions 3.4.2 and earlier. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid connecting to untrusted or malicious rsync servers. Monitoring for updates from the RsyncProject is recommended to apply any forthcoming patches promptly.