Which versions of RustDesk Client are affected by CVE-2026-30798?

RustDesk Client versions through 1.4.5 contain a network-accessible denial-of-service vulnerability that could disrupt remote access operations for affected users.

Is there a public PoC exploit available for CVE-2026-30798?

Yes, a public proof-of-concept exploit is available for CVE-2026-30798. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30798?

Within 24 hours: Inventory all RustDesk Client deployments, identify systems running versions 1.4.5 and earlier, and prioritize business-critical remote access infrastructure. Within 7 days: Deploy network-based detection rules to identify anomalous RustDesk heartbeat traffic patterns; develop incident response procedures for RustDesk service disruptions; identify and test alternative remote access solutions for critical operations. Within 30 days: Monitor vendor security advisories for patch release and establish rapid deployment procedures; upgrade all affected systems to patched version once available; evaluate whether RustDesk remains appropriate for business-critical remote access.

RustDesk Client CVE-2026-30798

Q: What is the CVSS score of CVE-2026-30798?

CVE-2026-30798 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-03-05 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe

Rustdesk Microsoft Google Apple Information Disclosure

8.2

CVSS 4.0 · Vendor: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe

Severity by source

Vendor (2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable heartbeat channel with no auth or UI (AV:N/PR:N/UI:N); AC:H reflects the AT:P requirement to deliver crafted hbbs sync traffic; impact is availability-only (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe).

CVSS VectorVendor: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 22, 2026 - 10:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 22, 2026 - 10:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 22, 2026 - 10:37 vuln.today

cvss_changed

CVSS changed

Jun 22, 2026 - 10:37 NVD

7.5 (HIGH) 8.2 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 20:25 vuln.today

Public exploit code

CVE Published

Mar 05, 2026 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines stop-service handler in heartbeat loop.

This issue affects RustDesk Client: through 1.4.5.

AnalysisAI

Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-access agent by manipulating heartbeat synchronization traffic, abusing weak authenticity checks in the hbbs_http/sync.rs heartbeat loop to trigger the stop-service handler. Publicly available exploit code exists, but EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis being tracked as actively exploited (not in CISA KEV).

Technical ContextAI

RustDesk is a popular open-source remote desktop platform whose clients (Windows, macOS, Linux, iOS, Android) maintain a persistent heartbeat with the rendezvous/relay server (hbbs) to receive policy and strategy updates. The flaw is rooted in CWE-345 (Insufficient Verification of Data Authenticity) combined with improper handling of exceptional conditions inside src/hbbs_http/sync.rs - the strategy-processing path of the heartbeat loop accepts crafted protocol messages without adequately validating their origin or contents, and the resulting exception flow can reach a stop-service handler that terminates the client agent. The CPE cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:-:*:*:* indicates all editions of the client up to and including 1.4.5 are in scope.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data - confirm against the RustDesk GitHub releases page and upgrade to the first release later than 1.4.5 that explicitly addresses the heartbeat sync authenticity issue once published. As compensating controls while unpatched, restrict client-to-hbbs traffic to a trusted self-hosted RustDesk relay (avoid the public rendezvous servers) and place that relay behind firewall ACLs that only allow expected client networks, which reduces exposure to attackers who can inject crafted heartbeat/strategy frames at the cost of breaking ad-hoc external connectivity. Additionally, monitor RustDesk client process state and auto-restart on unexpected stop-service termination to limit the operational impact of a DoS, accepting that this masks rather than fixes the underlying issue. Reference materials: vendor docs at https://rustdesk.com/docs/en/client/, exploit/details document linked from NVD at https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub, and third-party advisory site https://www.vulsec.org/.