RustDesk CVE-2026-76840

Exploitation requires three specific conditions. First, the attacker must control or have compromised the remote peer machine in the RustDesk session - the overflow is triggered by the peer's CLIPRDR_FILE_CONTENTS_RESPONSE, so an attacker cannot exploit this without controlling the other end of the session. Second, the local user must actively initiate a paste operation involving clipboard file contents offered by the remote side (e.g., pressing Ctrl+V in Windows Explorer after the remote advertised file clipboard data); the overflow does not occur on connect or on clipboard advertisement alone. Third, this vulnerability is Windows-specific and only affects deployments where clipboard file redirection is enabled (which is the default in RustDesk). Factors limiting exploitation: the attacker cannot be a passive network observer - they must operate the peer machine; the user interaction requirement (a paste action) provides a weak but real gate; and the exploit must produce a controlled heap overflow in explorer.exe, which requires bypassing modern heap mitigations (ASLR, heap integrity checks) to achieve reliable code execution beyond a crash.

The CVSS 4.0 score of 8.5 with vector AV:N/AC:L/AT:N/PR:N/UI:P reflects a realistic threat model: network-reachable, low complexity, requiring only passive user interaction (a paste action). The scope change to subsequent systems (SI:H/SA:H) is well-supported - the overflow targets explorer.exe's heap, not RustDesk's own process, meaning successful exploitation compromises the shell host process with full user-context capabilities. UI:P correctly captures that the local user must perform a paste operation, which is a weak gate in a remote-desktop workflow where users routinely transfer files. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. KEV listing is absent, indicating no confirmed active exploitation at time of analysis. However, the root cause is precisely described and a public reference fix exists from FreeRDP CVE-2026-68579, significantly reducing the reverse-engineering burden for a motivated attacker. Exploitation requires the attacker to control or compromise the remote peer machine - a meaningful prerequisite that limits opportunistic mass exploitation compared to a pure client-side vulnerability. Even so, teams operating RustDesk deployments in environments where peers cannot be fully trusted should treat this as urgent, given the low complexity once peer control is established and the high-impact target (explorer.exe heap corruption). CVSS and technical signals are consistent; no conflicting data was identified.

An attacker who controls or has compromised a machine running a RustDesk server instance waits for a victim to connect via RustDesk client on Windows. The attacker places a specially crafted file on the remote clipboard, which the victim's local client advertises as available for paste. When the victim performs a paste operation (e.g., Ctrl+V in Windows Explorer), explorer.exe requests file content via IStream::Read; the attacker's peer responds with a CLIPRDR_FILE_CONTENTS_RESPONSE whose cbRequested field far exceeds the IStream caller's buffer size, causing CopyMemory to write attacker-controlled bytes past the end of the explorer.exe heap allocation. No public exploit code has been identified at time of analysis, but the fix PR publicly documents the exact vulnerable code path, providing a blueprint for exploit development.