A heap-based buffer overflow vulnerability (CVE-2024-12084) exists in the rsync daemon due to improper handling of attacker-controlled checksum lengths. This flaw allows out-of-bounds writes in the sum2 buffer when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH of 16 bytes. The vulnerability has a critical severity with a CVSS score of 9.8. Red Hat has issued a patch for Red Hat Enterprise Linux 10 to address this issue.