Dashboard / CVE-2024-12084

CVE-2024-12084

CRITICAL 3 PoCs
ACT NOW Priority: 7.11 BB Relevance: 100/100
Published: 2025-01-15 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

Weakness Classification (2)

Affected Software (12)

VendorProductVersion
— — 3.2.7
— — 3.3.0
almalinux almalinux 10.0
archlinux arch_linux -
gentoo linux -
nixos nixos < 24.11
nixos nixos 24.11
novell suse_linux -
redhat enterprise_linux 10.0
samba rsync 3.2.7
samba rsync 3.3.0
tritondatacenter smartos < 20250123

References & Advisories (8)

https://kb.cert.org/vuls/id/952657
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2330527
Issue Tracking Third Party Advisory

Proof of Concept (3)

★ 4
https://github.com/themirze/cve-2024-12084
nomi-sec
★ 1
https://github.com/rxerium/CVE-2024-12084
nomi-sec
★ 1
https://github.com/InkeyP/CVE-2024-12084
nomi-sec

Bug Bounty Relevance

100 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (3)
✓ High exploitation probability

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

72.51%
Raw Score 0.725140
Percentile 99.4%
Date 2026-11-08

EPSS Trend

2026-11-08
0.72514
2026-11-07
0.72514
2026-11-06
0.72514
2026-11-05
0.72514
2026-11-04
0.72514

Intelligence Sources

mitre ref →
nvd ref →

External Links