RustDesk CVE-2026-73108

No special configuration is required - exploitation targets the pre-authentication TCP frame parsing path, which is active by default on any network-reachable RustDesk relay or rendezvous server. The CVSS PR:N and UI:N metrics confirm that neither authentication nor user interaction is needed. The only prerequisite is TCP reachability to the port on which the RustDesk server component listens. Exploitation amplification increases with the number of concurrent connections an attacker can sustain. Limiting factors: the attack yields only availability impact with no data access or code execution; deployments behind firewalls, VPNs, or NAT that prevent arbitrary external TCP connections are not directly reachable; and the fix has been released in version 1.4.7, meaning patched servers are fully protected.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N is well-calibrated to the actual threat: the attack is network-reachable, requires zero authentication or user interaction, has no special attack requirements, and produces high availability impact. The vulnerability is automatable - a simple loop opening concurrent TCP connections and writing four bytes per connection is sufficient to trigger exhaustion, with no payload delivery needed. EPSS data is absent from the provided input, so exploitation probability cannot be quantified precisely, though the extremely low barrier (no auth, no complexity, commit diff fully public) implies meaningful real-world exploitation risk now that the patch differential is visible. This CVE is not in the CISA KEV and no confirmed POC has been reported, so treating it as confirmed-exploited would overstate current evidence. The impact is strictly availability - no confidentiality or integrity consequence - but for self-hosted relay or rendezvous servers exposed to the internet, a successful attack denies remote desktop service to all connected users simultaneously. Deployments protected behind firewalls or VPNs that restrict arbitrary TCP connectivity face substantially lower exposure.

An attacker scripts a loop that opens dozens to hundreds of concurrent TCP connections to a publicly exposed RustDesk relay or rendezvous server and, on each connection, immediately writes a crafted four-byte frame header encoding a payload length of 0x3FFFFFFF (~1 GiB). The server's BytesCodec decoder reserves up to 1 GiB of heap memory per connection before any authentication exchange, and the attacker never sends a payload - connections are held open to sustain the allocated memory. Across 8-16 parallel connections this can exhaust tens of gigabytes of RAM, triggering OOM-kills or process crashes and rendering the server unavailable to legitimate users.