RustDesk Client
CVE-2026-30798
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify reachable RustDesk client
-
DeliveryPosition on path to hbbs server
-
ExploitCraft malicious heartbeat sync message
-
InstallBypass authenticity check in sync.rs
-
C2Trigger exception in strategy processing
-
ExecuteInvoke stop-service handler
-
ImpactTerminate RustDesk agent (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Attacker needs network reachability to the RustDesk client's heartbeat/strategy channel - typically by controlling, MitM-ing, or impersonating the hbbs rendezvous/relay server the client is configured to talk to - and must send a crafted protocol message that the sync.rs heartbeat loop will process. No user interaction, no local access, and no authentication to the client are required (PR:N/UI:N), and the issue is reachable on default RustDesk Client installs through 1.4.5 on any supported platform. Limiting factors: AT:P signals an environmental prerequisite (the attacker must be able to deliver traffic that the client treats as legitimate hbbs sync data), so deployments using a hardened self-hosted hbbs on a private network with strict ACLs materially reduce realistic exposure; impact is bounded to availability of the RustDesk service on the endpoint, not the host OS. |
| Impact | Signals are mixed and skew lower than the headline 8.2 score suggests. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) shows network-reachable, unauthenticated abuse, but impact is limited strictly to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity loss and no scope change. EPSS is 0.02% (5th percentile) and the vulnerability is not in CISA KEV, indicating no observed mass exploitation, though publicly available exploit code raises the floor for opportunistic abuse. The AT:P (attack requirements) sub-metric implies the attacker needs a usable network path to the heartbeat channel, which in typical RustDesk deployments using public/self-hosted hbbs servers is plausible. Net assessment: a credible remote DoS against deployed RustDesk endpoints, but not a confidentiality/integrity emergency - prioritize patching but below RCE-class issues. |
| Exploit ScenarioDerived | An attacker on the network path between a RustDesk client and its hbbs server (or operating a malicious/compromised rendezvous server) sends a crafted heartbeat/strategy payload whose authenticity is not adequately verified by sync.rs. The malformed message drives the heartbeat loop into the stop-service handler, terminating the RustDesk agent on the victim endpoint and cutting off remote support sessions; publicly available exploit code lowers the bar for repeat or automated triggering against fleets of clients. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 22, 2026
Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-access agent by manipulating heartbeat synchronization traffic, abusing weak authenticity checks in the hbbs_http/sync.rs heartbeat loop to trigger the stop-service handler. Publicly available exploit code exists, but EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis being tracked as actively exploited (not in CISA KEV).
Earlier versions of this analysis (2)
Protocol manipulation in RustDesk Client through version 1.4.5 on Windows, macOS, Linux, iOS, and Android allows remote attackers to disrupt availability of the remote-access service by abusing the heartbeat synchronization loop and stop-service handler. The flaw stems from insufficient verification of data authenticity (CWE-345) in the hbbs_http/sync.rs module, and publicly available exploit code exists, though EPSS remains very low (0.02%) and the issue is not listed in CISA KEV.
Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation. [CVSS 7.5 HIGH]
RemediationAI
No vendor-released patch identified at time of analysis in the provided data - confirm against the RustDesk GitHub releases page and upgrade to the first release later than 1.4.5 that explicitly addresses the heartbeat sync authenticity issue once published. As compensating controls while unpatched, restrict client-to-hbbs traffic to a trusted self-hosted RustDesk relay (avoid the public rendezvous servers) and place that relay behind firewall ACLs that only allow expected client networks, which reduces exposure to attackers who can inject crafted heartbeat/strategy frames at the cost of breaking ad-hoc external connectivity. Additionally, monitor RustDesk client process state and auto-restart on unexpected stop-service termination to limit the operational impact of a DoS, accepting that this masks rather than fixes the underlying issue. Reference materials: vendor docs at https://rustdesk.com/docs/en/client/, exploit/details document linked from NVD at https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub, and third-party advisory site https://www.vulsec.org/.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RustDesk is a popular open-source remote desktop platform whose clients (Windows, macOS, Linux, iOS, Android) maintain a persistent heartbeat with the rendezvous/relay server (hbbs) to receive policy and strategy updates. The flaw is rooted in CWE-345 (Insufficient Verification of Data Authenticity) combined with improper handling of exceptional conditions inside src/hbbs_http/sync.rs - the strategy-processing path of the heartbeat loop accepts crafted protocol messages without adequately validating their origin or contents, and the resulting exception flow can reach a stop-service handler that terminates the client agent. The CPE cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:-:*:*:* indicates all editions of the client up to and including 1.4.5 are in scope.
Know when Rustdesk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable heartbeat channel with no auth or UI (AV:N/PR:N/UI:N); AC:H reflects the AT:P requirement to deliver crafted hbbs sync traffic; impact is availability-only (A:H, C/I:N).
Primary rating from Vendor (2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe).
CVSS VectorVendor: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Lifecycle Timeline
3DescriptionCVE.org
Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines stop-service handler in heartbeat loop.
This issue affects RustDesk Client: through 1.4.5.
Executive ViewAI
RustDesk Client versions through 1.4.5 contain a network-accessible denial-of-service vulnerability that could disrupt remote access operations for affected users. While the likelihood of exploitation remains very low (EPSS 0.02%), publicly available exploit code combined with the absence of vendor patches creates a medium-term risk requiring rapid inventory and mitigation planning.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation to restrict RustDesk traffic to authorized subnets and endpoints; deploy deep-packet inspection or anomaly detection to identify heartbeat manipulation attempts; establish redundant or alternative remote access mechanisms for business-critical systems; maintain documented incident response procedures for RustDesk availability disruptions; consider temporarily restricting RustDesk use to non-critical functions until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Related Vulnerabilities in RustDesk Client and Server Authentication Flaws
View all 15A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Au
Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse i
Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote
GitHub PoC
Exploit-DB