A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Public exploits 1
- Otsutez/cve-2024-12085 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Change history 1
- First seenCVSS 7.5 · samba, redhat, almalinuxNVD modified 2026-10-13 03:16
Affected (CPE criteria) 63
cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift:5.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.15:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.16:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.17:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.2_aarch64:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.2_s390x:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.8_ppc64le:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*- and 23 more
References 29
- https://access.redhat.com/errata/RHBA-2025:6470
- https://access.redhat.com/errata/RHSA-2024:6122
- https://access.redhat.com/errata/RHSA-2025:0324 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0325 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0637 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0688 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0714 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0774 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0787 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0790 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0849 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0884 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:0885 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:1120 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:1123 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:1128 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:1225 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:1227 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:1242 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:1451 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:21885
- https://access.redhat.com/errata/RHSA-2025:2701 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-12085 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2330539 Issue Tracking, Third Party Advisory
- https://kb.cert.org/vuls/id/952657 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20250131-0002/
- https://www.kb.cert.org/vuls/id/952657
- https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj Exploit, Third Party Advisory