RustDesk EUVD-2026-66421

Exploitation requires three concurrent conditions: (1) an active, established RustDesk peer session where the attacker controls the remote endpoint - CVSS PR:L reflects this session-establishment prerequisite, meaning anonymous network scanning cannot trigger this flaw; (2) the macOS clipboard file-paste feature must be in use (this code path is macOS/unix-specific, per the Apple tag and the platform/unix directory in the fix); (3) the victim must initiate or accept a clipboard file-paste operation during the session - CVSS UI:P indicates passive user interaction is required, not a zero-click scenario. Exploitation is further limited to filesystem paths writable by the RustDesk process user, preventing writes to system-owned directories unless RustDesk runs with elevated privileges. This vulnerability cannot be triggered without a pre-established peer session and without the victim actively performing a paste.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N) accurately reflects the core risk profile: network-reachable, low complexity, but gated behind session establishment (PR:L) and passive user interaction (UI:P). The absence of a CISA KEV listing and no identified public exploit code indicate this has not been confirmed as actively exploited; EPSS data was not supplied, but the macOS-specific clipboard niche and session prerequisite make opportunistic mass exploitation unlikely. The VI:H impact is nonetheless meaningful - arbitrary file writes at the RustDesk process's privilege level can overwrite user-space configuration, drop persistent launchd plists, or corrupt application binaries, potentially escalating to code execution with additional attacker-controlled steps. No confidentiality impact is present (VC:N), and availability is unaffected (VA:N), which tempers urgency compared to a full RCE primitive. Organizations running RustDesk for unmanaged or peer-to-peer remote support, particularly with external or semi-trusted peers, face the most realistic exposure; internal enterprise deployments with controlled peer lists are at lower practical risk. The absence of scope change (SC:N/SI:N/SA:N) confirms the impact is contained to the vulnerable macOS system. Overall this is a genuine, patchable integrity risk - not inflated by speculative impact - but not an immediate crisis absent a public exploit.

An attacker who has established a RustDesk remote session with a macOS target - whether through legitimate access, credential theft, or social engineering - crafts clipboard file descriptors containing traversal sequences such as ../../Library/LaunchAgents/com.evil.plist. When the victim performs a clipboard paste operation to accept files from the remote peer, RustDesk writes the attacker-controlled file content to the traversed path rather than the intended paste destination, potentially achieving user-level persistence. No public exploit code has been identified at time of analysis.