CVE-2026-53792

Executive Summary

CVE-2026-53792 is an out-of-bounds read vulnerability in rsync versions prior to 3.5.0, residing in the sender-side block matching logic used during delta computation. A malicious receiver can trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a zero-length block, causing a negative offset calculation and subsequent out-of-bounds read of file data buffer memory on the sender side. The vulnerability is remotely exploitable against any rsync daemon or client session where an attacker controls the receiver side, with the primary impact being a denial-of-service condition on the sender; the CVSS 6.5 severity reflects a high availability impact with no confidentiality or integrity impact.

Technical Analysis

Vulnerability Mechanism. The flaw resides in rsync's block-matching algorithm, which is executed on the sender side during file delta computation. In rsync's protocol, the receiver (client) generates checksums for file blocks and sends them to the sender (server). The sender then scans its local file data to identify matching blocks. The vulnerability arises from insufficient validation of checksum block metadata received from the remote peer.

When the sender processes a checksum set from the receiver, it calculates block offsets within its local file buffer using lengths derived from the received metadata. A crafted checksum block specifying a length of zero (0) causes the sender to compute a negative offset during the delta computation loop. The code performs pointer arithmetic based on this offset, resulting in a memory read that occurs before the start of the allocated file data buffer. This is an out-of-bounds read of the heap region preceding the buffer.

Root Cause Classification. The issue is categorized as CWE-129 (Improper Validation of Array Index), as the input-controlled length value is used directly in offset arithmetic without proper bounds or sign validation. The vulnerability does not require authentication, but exploitation requires interaction with a running rsync process — either a client connecting to a malicious server, or a server accepting connections from a malicious client (the receiver role in the protocol).

Attack Surface.

• Network-exposed rsync daemons (default TCP port 873) are directly exploitable by an unauthenticated remote attacker who initiates a transfer and plays the receiver role.
• Client-side exploitation is possible when an rsync client connects to a malicious or compromised rsync server, which then sends the crafted checksum set to the client's sender logic.
• Passive or scheduled backup pipelines leveraging rsync are affected if they connect to untrusted endpoints.

Version Scope. All rsync versions prior to 3.5.0 are affected. The vendor has not yet published a formal advisory or CVE description beyond the NVD entry; patch verification is pending (0/4 confidence).

Exploitation Scenarios

Reconnaissance / Target Identification. An attacker identifies rsync services via network scanning for TCP port 873 or by fingerprinting rsync protocol banners (e.g., "@RSYNCD: 31.0"). Alternatively, an attacker can set up a malicious rsync server and wait for legitimate clients to connect, luring them via watering-hole techniques or compromised mirror repositories.

Triggering the Flaw. The attacker (acting as the receiver in the rsync protocol) initiates a transfer request for a file on the target (sender). During the checksum negotiation phase, the attacker sends a crafted checksum set containing a block descriptor with a length value of zero (0). The sender's block-matching logic processes this zero-length block, computes a negative offset into its file data buffer, and performs a read operation at that invalid memory location.

Payload / Execution Method. No specific payload bytes are required beyond the crafted protocol message containing the zero-length block. The attack is a protocol-level manipulation, not a code injection; the malicious receiver only needs to construct a valid rsync protocol message with malformed checksum metadata. The out-of-bounds read triggers a segmentation fault or heap corruption detection in the sender process, causing it to crash.

Post-Exploitation Impact. The primary outcome is a denial-of-service condition on the sender side — repeated crafted connections can crash the rsync daemon or client process. Since the read is out-of-bounds but does not write data, memory disclosure is theoretically possible if the process does not crash on the first attempt (e.g., if the invalid read crosses into mapped but unintended memory), though the NVD description indicates the primary impact is availability (A:H) with no confidentiality (C:N) or integrity (I:N) impact. No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Impact Assessment

• Confidentiality Impact: None (CVSS C:N) — the out-of-bounds read does not exfiltrate data in a reliable or operator-controlled manner.
• Integrity Impact: None (CVSS I:N) — no write operations occur; data corruption is not possible.
• Availability Impact: High (CVSS A:H) — a single crafted connection can crash the rsync process; repeated exploitation yields sustained denial of service.
• Attack Complexity: Low (AC:L) — no special conditions beyond protocol access; the malformed checksum can be sent during a standard handshake.
• Privileges Required: None (PR:N) — exploitation is possible pre-authentication on a default rsync daemon.
• User Interaction: Required (UI:R) — the attack requires a legitimate rsync session to be initiated, either by the attacker connecting to a victim daemon or by a victim client connecting to a malicious server.
• Business Impact: rsync is widely deployed in backup pipelines, CI/CD artifact mirrors, log shipping, and file replication across data centers. A crash in the sender process interrupts scheduled data flows, potentially delaying or losing backups, causing cascading failures in automation workflows, and consuming operational resources for restarts.

Detection Guidance

Sigma Rule

title: Suspicious Rsync Checksum Block Zero-Length Detection
id: 7f3e1d9a-4b2c-4f6e-8a1d-3c9e5b7f2a11
status: experimental
description: Detects rsync transfer failures caused by zero-length checksum blocks, indicating potential CVE-2026-53792 exploitation attempts.
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/rsync'
    CommandLine|contains|all:
      - '--checksum'
      - '--protocol=31'
  condition: selection
level: medium
falsepositives:
  - Legitimate rsync transfers with unusual protocol flags
tags:
  - attack.t1190
  - cve.2026.53792

YARA Rule

rule rsync_zero_length_checksum_CVE_2026_53792
{
    meta:
        author = "Valtersit Cyber Threat Intel"
        description = "Detects rsync protocol messages containing zero-length checksum blocks indicative of CVE-2026-53792"
        date = "2026-02-10"
        cve = "CVE-2026-53792"
        severity = "medium"

    strings:
        $rsync_magic = { 40 52 53 59 4E 43 44 }  // "@RSYNCD"
        $zero_block_16 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $zero_block_4 = { 00 00 00 00 }

    condition:
        $rsync_magic at 0 and ($zero_block_16 or $zero_block_4)
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"ET EXPLOIT rsync Zero-Length Checksum Block (CVE-2026-53792)"; flow:to_server,established; content:"@RSYNCD"; offset:0; depth:8; content:"|00 00 00 00|"; within:16; sid:202653792; rev:1; reference:cve,2026-53792; classtype:attempted-dos; metadata:created_at 2026_02_10;)

Elastic Detection

sequence by host.name, process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name == "rsync" and process.args in ("--checksum", "--protocol=31")]
  [process where event.type == "end" and process.exit_code != 0 and process.args in ("--checksum", "--protocol=31")]

Splunk SPL Query

index=main sourcetype=linux:process
| where match(process, "(?i)rsync")
| search process_arguments="*--checksum*" OR process_arguments="*--protocol=31*"
| stats count by host, process, exit_code
| search count > 3 AND process_status="failed"
| table _time, host, process, exit_code, process_arguments

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="100537" level="10">
    <decoded>rsync\s*:\s*connection\s*reset|rsync\s*error:\s*protocol\s*version\s*error</decoded>
    <description>CVE-2026-53792: Potential rsync zero-length checksum exploitation (crash detected)</description>
    <group>cve-2026-53792,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status. The upstream fix is scheduled for rsync 3.5.0, which is not yet released. Patch confidence is rated 0/4 — no vendor advisory, no backported patches to current distribution versions, and no workaround has been published by the vendor or distro maintainers as of this writing.

Immediate Mitigations (until 3.5.0 is available):

1. Restrict Network Exposure: Disable rsync daemon mode (--daemon) on multi-user or internet-reachable hosts. If the daemon is required, firewall TCP port 873 to trusted IP ranges only.
2. Use SSH Tunneling: Replace direct rsync daemon connections with rsync -e ssh. SSH transport wraps the rsync protocol, and the AllowTcpForwarding no setting on the SSH server can further constrain exposure. Note: this only masks the vulnerability from external attackers — it does not fix the underlying flaw.
3. Prefer Push-Only Transfers: Configure backup pipelines so that the sender (which contains valuable file data) initiates the connection, minimizing the attack surface where a malicious receiver can connect inbound.
4. Monitor for Crashes: Enable core dumps and process monitoring on rsync daemons; alert on frequent non-zero exit codes in rsync processes to detect active exploitation attempts.

Patch/Upgrade Steps:

1. Track the rsync mailing list and distribution security trackers for the 3.5.0 release announcement.
2. Test the 3.5.0 upgrade in a staging environment that mirrors production transfer patterns prior to fleet rollout.
3. Apply distribution-provided security backports as they become available (Debian, Red Hat, Alpine, etc.).

Long-Term Hardening:

1. Implement network segmentation so rsync traffic is confined to dedicated backup VLANs.
2. Deploy intrusion detection rules (see Detection Guidance) on ingress/egress network monitoring points near rsync daemons.
3. Enforce least-privilege access controls on rsync module configuration (read only = true where possible).
4. Consider transitioning to rsync over SSH with forced-command restrictions using rsync --server command wrappers in authorized_keys to constrain peer capabilities.

References

1. NVD Entry — CVE-2026-53792: https://nvd.nist.gov/vuln/detail/CVE-2026-53792
2. rsync Official Repository: https://github.com/WayneD/rsync (watch for 3.5.0 release tags)
3. rsync Mailing List (rsync-announce): https://lists.samba.org/mailman/listinfo/rsync-announce
4. CWE-129 — Improper Validation of Array Index: https://cwe.mitre.org/data/definitions/129.html
5. FIRST.org EPSS — CVE-2026-53792 (not yet scored): https://www.first.org/epss/

Known Threat Actor Activity: No proof-of-concept, exploit code, or in-the-wild exploitation has been publicly confirmed as of this report's date. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Because rsync is a ubiquitous component in backup and mirroring infrastructure, network awareness of this CVE should be treated as a priority for defensive monitoring despite the lack of known active campaigns.