The rsync utility in Red Hat Enterprise Linux 9 contains a vulnerability (CVE-2025-10158) characterized by an out-of-bounds array access caused by a negative index. This flaw is classified under CWE-129 (Improper Validation of Array Index). Red Hat Product Security has issued an advisory (RHSA-2026:6390) describing the issue and providing updated packages that fix the vulnerability. The update is available for various architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS score is provided, but the vendor rates the impact as moderate. There are no known exploits in the wild at this time.

The vulnerability allows out-of-bounds array access in the rsync utility, which could potentially cause crashes or other unintended behavior. While the exact impact is not detailed beyond this, such flaws can sometimes be leveraged to cause denial of service or potentially execute arbitrary code depending on context. Red Hat rates the security impact as moderate. There are no known active exploits targeting this vulnerability currently.

Red Hat has released updated rsync packages that address this vulnerability. Users running affected versions of Red Hat Enterprise Linux 9 should apply the security update as described in the Red Hat advisory RHSA-2026:6390 and the referenced article (https://access.redhat.com/articles/11258). Applying this official fix will remediate the vulnerability. No additional mitigation steps are indicated by the vendor.