7.5

CVE-2024-12085: almalinux Use of Uninitialized Resource

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2024-12085RHSA-2025:0324RHSA-2025:0325
Published 14-01-2025Last modified 13-10-2026
Open JSON

Vulnerability summary

CVE-2024-12085 is a high (CVSS 7.5) Use of Uninitialized Resource vulnerability in almalinux. EPSS estimates a 8.82% chance of exploitation in the next 30 days, higher than 95.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
8.82%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 12 · Related 9
DLA-4015-1DSA-5843-1MGASA-2025-0019OPENSUSE-SU-2025:14665-1RHBA-2025:6470SUSE-SU-2025:0156-1

Timeline

  1. 14-01-2025
    PublishedVulnerability first disclosed.
  2. 13-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

8.82%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.82% on 18-09-2026

18-09-202618-10-2026
EPSS score
8.82%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Security Research

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat19 products
Almalinux1 product
Alpine1 product
  • rsync< 3.4.0-r0
Archlinux1 product
Debian1 product
  • rsync< 3.2.7-1+deb12u1 | < 3.3.0+ds1-3
Gentoo1 product
Nixos1 product
Samba1 product
Suse1 product
Tritondatacenter1 product
Ubuntu1 product
  • rsync< 3.1.0-2ubuntu0.4+esm1 | < 3.1.1-3ubuntu1.3+esm3 | < 3.1.2-2.1ubuntu1.6+esm1 | < 3.1.3-8ubuntu0.8 | < 3.2.7-0ubuntu0.22.04.3 | < 3.2.7-1ubuntu1.1

11 vendors · 29 products

References

49 links
Show all 49 references