RustDesk CVE-2026-100388

Requires an already-established, authenticated RustDesk peer connection to a Linux or macOS host on which the file-transfer permission is DISABLED - the defect is that the Cliprdr message handler serves incoming file-clipboard (FormatDataRequest / FileContentsRequest) messages without calling file_transfer_enabled(). Exploitation is limited to hosts running RustDesk before 1.5.0 on Linux/macOS; Windows is not named. The primary limiting factor is that the attacker must be an authorized connected peer (PR:L), so this escalates the reach of an existing restricted session rather than granting unauthenticated access; no additional user interaction is required.

This is a genuine but low-severity, session-gated issue rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, base 5.3) correctly reflects the shape of the flaw: network-reachable and low-complexity, but requiring an already-authenticated, connected peer (PR:L) and yielding only limited confidentiality and integrity impact (VC:L/VI:L, no availability impact). No EPSS score, no CISA KEV listing, and no public weaponized exploit are present in the supplied intelligence, so there is no public exploit identified at time of analysis and no signal of active or automatable exploitation. The core precondition materially limits real-world risk: an attacker must first establish an authorized RustDesk session with the victim. The signals are internally consistent - a low-privilege-required missing-authorization bug (CWE-862) with limited impact and no exploitation evidence - so this is a legitimate authorization-hardening fix, not a high-CVSS/low-real-risk mismatch. Note that the CWE (862, missing authorization) and the input tag 'Authentication Bypass' conflict: this is an authorization bypass within an authenticated session, not an authentication bypass.

An attacker who holds an authorized (but supposedly restricted) RustDesk control session to a Linux or macOS host - one where the file-transfer permission is explicitly disabled - sends crafted Cliprdr file-clipboard messages. Because the Cliprdr handler never checks file_transfer_enabled() for incoming file-data requests, the peer can push files onto the host clipboard and pull back files and clipboard contents from the process-wide clipboard cache, defeating the disabled-file-transfer control. No public proof-of-concept is identified in the supplied data.