The rsync utility, which synchronizes files efficiently by sending only differences, contains two vulnerabilities: an out-of-bounds array access triggered by a negative index (CVE-2025-10158) and a use-after-free vulnerability in handling extended attributes (CVE-2026-41035). Both vulnerabilities affect Red Hat Enterprise Linux 9.2 and related variants. Red Hat has issued security updates that fix these issues. The advisory does not provide CVSS scores but rates the impact as Important. No exploits are currently known in the wild.

Successful exploitation of these vulnerabilities could lead to memory corruption issues such as crashes or potentially arbitrary code execution due to out-of-bounds access and use-after-free conditions in rsync. The exact impact details and CVSS scores are not provided in the advisory. There are no known active exploits targeting these vulnerabilities at this time.

Red Hat has released updated rsync packages for affected versions of Red Hat Enterprise Linux 9.2 and related products. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the provided patches.