EUVD-2026-66421Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects the required established peer session; UI:R for victim's active paste action; integrity-only impact with no confidentiality or availability effect from this write-primitive.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an active clipboard file-paste session can use parent-directory components or absolute paths to write files outside the intended target directory at locations writable by the RustDesk process. Commit 6f1eb16 fixes the issue by validating descriptor names and safely joining paths.
AnalysisAI
Path traversal in RustDesk's macOS clipboard file-paste feature allows a remote session peer to write files outside the intended target directory by supplying crafted file descriptor names containing parent-directory components or absolute paths. Versions 1.3.9 through 1.4.9 on macOS are affected; exploitation requires an active RustDesk session and passive victim interaction (initiating a clipboard paste). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) an active, established RustDesk peer session where the attacker controls the remote endpoint - CVSS PR:L reflects this session-establishment prerequisite, meaning anonymous network scanning cannot trigger this flaw; (2) the macOS clipboard file-paste feature must be in use (this code path is macOS/unix-specific, per the Apple tag and the platform/unix directory in the fix); (3) the victim must initiate or accept a clipboard file-paste operation during the session - CVSS UI:P indicates passive user interaction is required, not a zero-click scenario. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N) accurately reflects the core risk profile: network-reachable, low complexity, but gated behind session establishment (PR:L) and passive user interaction (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has established a RustDesk remote session with a macOS target - whether through legitimate access, credential theft, or social engineering - crafts clipboard file descriptors containing traversal sequences such as ../../Library/LaunchAgents/com.evil.plist. When the victim performs a clipboard paste operation to accept files from the remote peer, RustDesk writes the attacker-controlled file content to the traversed path rather than the intended paste destination, potentially achieving user-level persistence. … |
| Remediation | The primary remediation is to update RustDesk to a version incorporating commit 6f1eb164d616e0e2bfbcf8c6b7c8083b09d7ed06, accessible via GitHub PR #15693 at https://github.com/rustdesk/rustdesk/pull/15693 and the commit at https://github.com/rustdesk/rustdesk/commit/6f1eb164d616e0e2bfbcf8c6b7c8083b09d7ed06. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Au
Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-acce
Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse i
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remot
Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote
Configuration tampering in RustDesk Client through 1.4.5 allows a network-positioned attacker to manipulate Application
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive
RustDesk Server Pro through version 1.7.5 transmits sensitive address book credentials in cleartext over the network hea
Authentication bypass in RustDesk Client through 1.4.5 across Windows, macOS, Linux, iOS, and Android allows remote atta
Privilege escalation in RustDesk Client through version 1.4.5 on Windows, macOS, Linux, iOS, and Android allows unauthen
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today