EUVD-2026-87353Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish authenticated peer session to Windows host
-
DeliverySend FormatDataRequest for FileGroupDescriptorW
-
ExploitGuess format identifier
-
ExecutionIssue FileContentsRequest messages
-
ImpactExfiltrate host clipboard files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an active, authenticated RustDesk peer connection to a Windows host (PR:L) running a version before 1.5.0 that has the one-way file transfer option configured - the very control the attacker bypasses. Exploitation further depends on the victim having copied files to the host clipboard at the time of the request (reflected as AT:P), since only clipboard-resident files can be retrieved. This is Windows-only; the Linux/macOS behavior is tracked separately (CVE-2026-100388). No user interaction beyond the existing session is needed, but the attacker cannot exploit an unauthenticated or idle-clipboard target, which sharply limits real-world impact. |
| Impact | This is a low-priority, low-real-risk issue despite carrying a valid CVE. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N) scores only 2.3 - confidentiality-only impact, no integrity or availability effect, and it requires an already-authenticated peer connection (PR:L) plus an attack requirement (AT:P) reflecting that files must actually be sitting on the host clipboard at exploitation time. No EPSS score, KEV listing, or public POC was provided, so exploitation probability signals are absent rather than elevated. The flaw is reported by VulnCheck (an advisory exists) and a vendor patch is confirmed via the RustDesk PR/commit, but there is no evidence of active exploitation. The CWE-862 (missing authorization) classification is consistent with the description: an authorization check (one-way file transfer / file_transfer_enabled) was simply not enforced against inbound clipboard file-data requests. Net: a genuine but narrow information-disclosure bug gated by an active authenticated session and by the victim having copied files to the clipboard. |
| Exploit ScenarioDerived | An attacker who already holds an authenticated RustDesk peer session to a Windows host - where the operator believed the one-way file transfer restriction blocked outbound file flow - sends crafted clipboard protocol messages (FormatDataRequest followed by FileContentsRequest) and guesses the FileGroupDescriptorW format identifier to enumerate and retrieve files the victim has copied to their clipboard. No public exploit was identified at time of analysis, though the fixing PR and the referenced 1.4.9 source lines effectively document the mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Authenticated peers connected to a Windows RustDesk host running a version before 1.5.0 can bypass the one-way file transfer setting and pull files straight out of the victim's clipboard. Because the same option that is meant to prevent the local machine from serving clipboard files is the one being ignored, an attacker who already holds a valid remote session can send crafted clipboard-redirection messages (FormatDataRequest / FileContentsRequest) and, by supplying the known FileGroupDescriptorW format identifier, receive the contents of any file the user has copied. Rated only 2.3 under CVSS v4.0 (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the issue yields confidentiality impact only, requires an authenticated peer relationship plus a clipboard that already holds files, and no public exploit has been identified at time of analysis.
RemediationAI
Upgrade RustDesk on Windows to version 1.5.0 or later, which incorporates the upstram fix. The patch is delivered through GitHub pull request #16333 and commit f299fb9906006247863250d7dfaa016f29eef7a4, which adds an is_file_data_request() check so that FormatDataRequest and FileContentsRequest messages are no longer answered with the local clipboard's files when the one-way file transfer option is set; RustDesk 1.5.0 is the release in which that fix is understood to land, though the provided data references a PR/commit rather than a tagged release artifact. Until upgrading, the most direct compensating control is to disable clipboard file copy/paste (and ideally clipboard sharing entirely) for hosts that accept remote sessions, accepting that this removes legitimate paste functionality for all peers, or to strictly restrict which peer IDs may establish sessions so that only fully trusted operators can connect, acknowledging that this does not remove the missing authorization check for a malicious authenticated peer. Keep the one-way file transfer setting enabled as defense in depth but do not rely on it alone, since it is the control being bypassed, and avoid leaving sensitive files on the clipboard during remote sessions. Applicable advisories and fix references are https://github.com/rustdesk/rustdesk/pull/16333, https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4, and https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-one-way-file-transfer-bypass.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RustDesk implements remote clipboard sharing over the Microsoft Remote Desktop Protocol clipboard-redirection virtual channel (CLIPRDR), where peers exchange typed messages such as FormatList, FormatDataRequest/Response, FileContentsRequest/Response and FileGroupDescriptorW. The vulnerable logic lives in the Rust implementation (src/clipboard_file.rs and src/server/connection.rs) and the Windows clipboard file backend (libs/clipboard/src/windows/wf_cliprdr.c). The root cause is CWE-862 (Missing Authorization): when the built-in OPTION_ONE_WAY_FILE_TRANSFER flag is set to "Y", the server failed to suppress this side's clipboard file serving, so incoming FormatDataRequest and FileContentsRequest messages were still answered with host clipboard data instead of being dropped. An attacker only needs to know the well-known FileGroupDescriptorW format identifier to request and enumerate copied files. The upstream fix in PR #16333 introduces an is_file_data_request() helper that identifies FormatDataRequest and FileContentsRequest messages, and the connection handler now refuses to serve local clipboard files when one-way file transfer is enabled, while still allowing the peer's own clipboard-file messages such as MonitorReady, FormatList, FormatDataResponse and Files. The same class of behavior on Linux/macOS is tracked separately as CVE-2026-100388.
Know when Rustdesk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated peer session required (PR:L), network-reachable protocol messages (AV:N/AC:L), and only limited disclosure of clipboard files (C:L) with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Au
Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-acce
Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse i
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remot
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remot
Unauthenticated attackers can abuse missing authorization controls in RustDesk Server's rendezvous and relay modules (hb
Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat
RustDesk Server Pro through version 1.7.5 uses weak cryptographic algorithms in configuration string generation and web
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote
Configuration tampering in RustDesk Client through 1.4.5 allows a network-positioned attacker to manipulate Application
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object protot
Exploit-DB