The vulnerability in rsync 3.2.3 up to 3.4.4 is caused by incorrect calculation of buffer size in the parse_size_arg() function. Specifically, the return value of snprintf(), which indicates the number of characters that would have been written including truncated parts, is used directly as an index into a .bss-segment array without verifying that it is within bounds. When snprintf truncates the output, this index can exceed the array length, resulting in an out-of-bounds write that corrupts memory.

This vulnerability can lead to memory corruption in the .bss segment of the rsync process. Such corruption may cause crashes or potentially enable an attacker to execute arbitrary code or cause denial of service. The CVSS 4.0 score of 8.3 reflects a high severity with network attack vector, high attack complexity, no privileges or user interaction required, and high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor vendor communications for updates and consider restricting access to vulnerable rsync services until a patch is available.