EUVD-2026-39976
GHSA-vp3r-hwqm-x826
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid FileTransfer authorization
-
DeliveryEstablish file-transfer session
-
ExploitSend keyboard/mouse and capture control messages
-
ExecutionCapability flags never cleared, handlers execute
-
PersistInject input and capture screen
-
ImpactInteractive control beyond granted scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first hold a valid FileTransfer authorization to the target RustDesk peer (PR:L) - an accepted file-transfer session must exist, so this is not a fully unauthenticated attack. Given that grant, no user interaction (UI:N) and no special or non-default configuration are needed, because the missing scope enforcement lives in the core control-message dispatch path: the file-transfer session never clears the keyboard/mouse and screen-capture capability flags. The principal limiting factor is therefore the need to obtain a FileTransfer authorization in the first place; deployments that never expose file-transfer access to untrusted or semi-trusted peers are not realistically exposed. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:L/VI:H/VA:L, base 7.2 High) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high integrity impact (input injection and control) and lower confidentiality and availability impact. Publicly available exploit code increases practical risk, but this CVE is not listed in CISA KEV and no EPSS probability was supplied, so there is no evidence of widespread automated exploitation. The decisive limiting signal is PR:L: the attacker must already hold a valid FileTransfer authorization, meaning this is fundamentally a scope-escalation issue against semi-trusted, file-only peers rather than a fully unauthenticated remote takeover. It is a genuine priority for environments that hand out file-transfer-only access to outside parties, but the privilege prerequisite tempers the raw High score for tightly controlled deployments. |
| Exploit ScenarioDerived | An attacker obtains a legitimate FileTransfer-only authorization to a RustDesk peer - for example, by posing as a vendor performing a file-only support task. Rather than limiting themselves to file transfer, they send keyboard and mouse control messages and invoke the screenshot/display-capture handlers, gaining interactive control and live screen visibility of the victim host. Publicly available proof-of-concept code (github.com/bikini/exploitarium) demonstrates the bypass, and the low attack complexity makes it reliable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 28, 2026
Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse input and invoke the screenshot and display-capture handlers, escalating a limited file-transfer session into full interactive remote control and screen surveillance. The defect arises because RustDesk gates incoming control messages on per-capability flags that a file-transfer session never clears, rather than on the session's authorized connection type. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the provided data (No vendor-released patch identified at time of analysis), so the primary action is to track the VulnCheck advisory (https://www.vulncheck.com/advisories/rustdesk-filetransfer-session-authorization-scope-bypass) and the upstream RustDesk project for a fixed release and upgrade to the exact patched version as soon as it is published. Until then, apply compensating controls: stop granting FileTransfer-only authorizations to semi-trusted parties since the scope is not enforced (trade-off: less convenient file-only support); require interactive accept-prompt approval for every incoming connection instead of unattended auto-accept so a human gates each session (trade-off: unattended endpoints can no longer be served); enforce strong, unique permanent passwords or disable unattended access to shrink the pool of peers that can obtain any authorization; and restrict network reachability of RustDesk peers via firewall rules or by routing only through a controlled self-hosted relay/ID server. Validate the exact fixed version against the vendor advisory before relying on an upgrade, and do not assume an upstream commit equals a released build.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RustDesk is a widely used open-source remote-desktop and remote-support application, identified by the single affected CPE cpe:2.3:a:rustdesk:rustdesk. The vulnerability is a CWE-863 (Improper Authorization) defect in the session-handling logic: incoming control messages are dispatched according to granular per-capability boolean flags instead of being validated against the connection type (e.g., FileTransfer versus full remote control) that the peer was actually authorized for. Because establishing a file-transfer session does not reset these capability flags, the keyboard/mouse input handlers and the screenshot/display-capture handlers stay reachable even though only file-transfer scope was negotiated. The root cause is conflating feature-level capability gating with session-level scope enforcement.
Know when Rustdesk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Network-reachable, low complexity, no UI; PR:L because a valid FileTransfer authorization is required; high integrity from input injection/control, lower confidentiality from screen capture and lower availability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.
Executive ViewAI
RustDesk contains an authorization bypass vulnerability (CVE-2026-58056, CVSS 7.2) allowing authenticated peers with limited file-transfer access to escalate into full interactive remote control and screen surveillance capability. Publicly available exploit code exists; organizations using RustDesk for remote administration or support face elevated risk of unauthorized system access and sensitive data exposure. Immediate action is required to audit and restrict RustDesk usage and implement compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict RustDesk file-transfer sessions to explicitly trusted networks with network-layer enforcement; (2) disable RustDesk on high-value targets (financial systems, data repositories, domain controllers) unless operationally required; (3) implement enhanced logging and alerting for keyboard/mouse input and screenshot operations initiated during file-transfer sessions; (4) conduct immediate audit of active RustDesk sessions for signs of escalation attempts; (5) implement network segmentation to limit lateral movement from any compromised RustDesk-accessible system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Au
Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-acce
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remot
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remot
Unauthenticated attackers can abuse missing authorization controls in RustDesk Server's rendezvous and relay modules (hb
Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat
RustDesk Server Pro through version 1.7.5 uses weak cryptographic algorithms in configuration string generation and web
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote
Configuration tampering in RustDesk Client through 1.4.5 allows a network-positioned attacker to manipulate Application
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object protot
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive
Exploit-DB