The rsync utility, which facilitates efficient file synchronization by sending only file differences, contains two vulnerabilities in Red Hat Enterprise Linux 9.4 Extended Update Support. The first is an out-of-bounds array access triggered by a negative index (CVE-2025-10158), and the second is a use-after-free vulnerability related to extended attribute handling (CVE-2026-41035). These vulnerabilities could potentially lead to memory corruption or other unintended behavior. Red Hat has released updated rsync packages to fix these issues, and the advisory RHSA-2026:20604 provides detailed information and instructions for applying the update.

The vulnerabilities could allow an attacker to cause memory corruption through out-of-bounds access or use-after-free conditions in the rsync utility. This could potentially lead to denial of service or other unintended behavior when processing files or extended attributes. However, no known exploits are reported in the wild at this time. The security impact is rated as important by Red Hat, indicating a high severity but not necessarily critical.

A security update for rsync addressing these vulnerabilities is available for Red Hat Enterprise Linux 9.4 Extended Update Support. Users should apply the update as described in the Red Hat advisory RHSA-2026:20604 and the article at https://access.redhat.com/articles/11258. Applying this update will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.