The vulnerability in rsync versions prior to 3.5.0 is due to improper validation of array indices in the sender-side block matching logic. A malicious receiver can send a specially crafted checksum set containing a zero-length block, which causes a negative offset calculation during delta computation. This results in an out-of-bounds read of the file data buffer memory on the sender side, potentially exposing memory contents or causing a crash.

An attacker controlling the receiver side of an rsync session can exploit this flaw to cause the sender to read memory out-of-bounds. This may lead to information disclosure or denial of service on the sender system. The CVSS 4.0 score is 7.1 (high severity), indicating significant risk without requiring privileges or user interaction beyond initiating a connection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates and avoid using vulnerable rsync versions in untrusted environments until a fix is available.