Rustdesk
Monthly
Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade server availability by sending crafted TCP frame headers through BytesCodec before any authentication occurs. The decoder blindly reserves up to 1,073,741,823 bytes of buffer capacity per connection based solely on an untrusted four-byte length field, and concurrent connections multiply the allocation pressure until host memory is exhausted. No public exploit code has been identified at time of analysis, though the upstream patch commit fully discloses the trigger mechanism; the fix is available in the vendor-released 1.4.7 build.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse input and invoke the screenshot and display-capture handlers, escalating a limited file-transfer session into full interactive remote control and screen surveillance. The defect arises because RustDesk gates incoming control messages on per-capability flags that a file-transfer session never clears, rather than on the session's authorized connection type. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.
Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-access agent by manipulating heartbeat synchronization traffic, abusing weak authenticity checks in the hbbs_http/sync.rs heartbeat loop to trigger the stop-service handler. Publicly available exploit code exists, but EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis being tracked as actively exploited (not in CISA KEV).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat synchronization, enabling network eavesdropping attacks across Windows, macOS, Linux, iOS, and Android platforms. An attacker positioned to intercept network traffic can capture authentication credentials by sniffing the unencrypted JSON payload. No patch is currently available for this high-severity vulnerability (CVSS 8.7).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
Configuration tampering in RustDesk Client through 1.4.5 allows a network-positioned attacker to manipulate Application API messages exchanged between the client and its rendezvous/sync server, altering client strategy and configuration options. The flaw spans every supported platform (Windows, macOS, Linux, iOS, Android, WebClient) and stems from insecure handling in the Strategy merge loop and Config::set_options(), giving an MitM attacker the ability to silently rewrite client behavior. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.05% (16th percentile).
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object prototype handling in its password security and configuration encryption modules, allowing local authenticated attackers to extract embedded sensitive data including passwords and machine identifiers. The vulnerability affects critical cryptographic functions including symmetric_crypt() and decrypt_str_or_original(), enabling attackers with local access and valid credentials to compromise encrypted credentials and system identifiers. No patch is currently available.
Unauthenticated attackers can abuse missing authorization controls in RustDesk Server's rendezvous and relay modules (hbbs/hbbr) to gain unauthorized privileges through exposed critical functions like punch hole requests and peer registration. This vulnerability affects RustDesk Server versions through 1.7.5 and 1.1.15, enabling remote privilege escalation over the network with no authentication required. No patch is currently available.
RustDesk Server Pro through version 1.7.5 uses weak cryptographic algorithms in configuration string generation and web console export functions, enabling attackers to extract sensitive embedded data from exported configurations. This vulnerability affects Windows, macOS, and Linux deployments and requires no authentication or user interaction to exploit. No patch is currently available.
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive embedded data during config import, URI scheme handling, or CLI operations across Windows, macOS, Linux, iOS, Android, and web clients. An unauthenticated remote attacker can exploit this vulnerability without user interaction to extract sensitive configuration information. No patch is currently available for this high-severity vulnerability.
Authenticated peers connected to a Windows RustDesk host running a version before 1.5.0 can bypass the one-way file transfer setting and pull files straight out of the victim's clipboard. Because the same option that is meant to prevent the local machine from serving clipboard files is the one being ignored, an attacker who already holds a valid remote session can send crafted clipboard-redirection messages (FormatDataRequest / FileContentsRequest) and, by supplying the known FileGroupDescriptorW format identifier, receive the contents of any file the user has copied. Rated only 2.3 under CVSS v4.0 (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the issue yields confidentiality impact only, requires an authenticated peer relationship plus a clipboard that already holds files, and no public exploit has been identified at time of analysis.
RustDesk before 1.5.0 on Linux and macOS fails to enforce its own file-transfer permission setting in the Cliprdr clipboard message handler, so an already-connected, authenticated peer whose file-transfer rights have been disabled can still push files onto the host's clipboard and pull back files and clipboard contents from the process-wide clipboard cache. Exploitation is network-reachable but session-gated: the attacker must first hold an authorized peer connection to the target host (CVSS 4.0 base 5.3, PR:L, C:L/I:L per the assessed vector), making this an escalation of an existing restricted session rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available from the upstream RustDesk project.
Path traversal in RustDesk's macOS clipboard file-paste feature allows a remote session peer to write files outside the intended target directory by supplying crafted file descriptor names containing parent-directory components or absolute paths. Versions 1.3.9 through 1.4.9 on macOS are affected; exploitation requires an active RustDesk session and passive victim interaction (initiating a clipboard paste). No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor fix is available via commit 6f1eb164.
RustDesk Server Pro through version 1.7.5 transmits sensitive address book credentials in cleartext over the network heartbeat synchronization API, enabling attackers to intercept and obtain authentication credentials without authentication. The vulnerability affects Windows, macOS, and Linux deployments where the address book sync functionality is enabled. No patch is currently available.
Authentication bypass in RustDesk Client through 1.4.5 across Windows, macOS, Linux, iOS, and Android allows remote attackers to replay captured session IDs and login proofs to impersonate legitimate peers without knowing the original credentials. The flaw stems from insufficient computational effort in the hash_password() routine combined with reusable session identifiers in the login proof construction, enabling capture-replay attacks against the peer authentication module. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.04% (12th percentile).
Privilege escalation in RustDesk Client through version 1.4.5 on Windows, macOS, Linux, iOS, and Android allows unauthenticated remote attackers to abuse API sync and configuration management functions. The vulnerability in the rendezvous mediator and HTTP sync modules enables attackers to gain elevated privileges without user interaction. No patch is currently available for affected users.
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade server availability by sending crafted TCP frame headers through BytesCodec before any authentication occurs. The decoder blindly reserves up to 1,073,741,823 bytes of buffer capacity per connection based solely on an untrusted four-byte length field, and concurrent connections multiply the allocation pressure until host memory is exhausted. No public exploit code has been identified at time of analysis, though the upstream patch commit fully discloses the trigger mechanism; the fix is available in the vendor-released 1.4.7 build.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse input and invoke the screenshot and display-capture handlers, escalating a limited file-transfer session into full interactive remote control and screen surveillance. The defect arises because RustDesk gates incoming control messages on per-capability flags that a file-transfer session never clears, rather than on the session's authorized connection type. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.
Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-access agent by manipulating heartbeat synchronization traffic, abusing weak authenticity checks in the hbbs_http/sync.rs heartbeat loop to trigger the stop-service handler. Publicly available exploit code exists, but EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis being tracked as actively exploited (not in CISA KEV).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat synchronization, enabling network eavesdropping attacks across Windows, macOS, Linux, iOS, and Android platforms. An attacker positioned to intercept network traffic can capture authentication credentials by sniffing the unencrypted JSON payload. No patch is currently available for this high-severity vulnerability (CVSS 8.7).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
Configuration tampering in RustDesk Client through 1.4.5 allows a network-positioned attacker to manipulate Application API messages exchanged between the client and its rendezvous/sync server, altering client strategy and configuration options. The flaw spans every supported platform (Windows, macOS, Linux, iOS, Android, WebClient) and stems from insecure handling in the Strategy merge loop and Config::set_options(), giving an MitM attacker the ability to silently rewrite client behavior. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.05% (16th percentile).
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object prototype handling in its password security and configuration encryption modules, allowing local authenticated attackers to extract embedded sensitive data including passwords and machine identifiers. The vulnerability affects critical cryptographic functions including symmetric_crypt() and decrypt_str_or_original(), enabling attackers with local access and valid credentials to compromise encrypted credentials and system identifiers. No patch is currently available.
Unauthenticated attackers can abuse missing authorization controls in RustDesk Server's rendezvous and relay modules (hbbs/hbbr) to gain unauthorized privileges through exposed critical functions like punch hole requests and peer registration. This vulnerability affects RustDesk Server versions through 1.7.5 and 1.1.15, enabling remote privilege escalation over the network with no authentication required. No patch is currently available.
RustDesk Server Pro through version 1.7.5 uses weak cryptographic algorithms in configuration string generation and web console export functions, enabling attackers to extract sensitive embedded data from exported configurations. This vulnerability affects Windows, macOS, and Linux deployments and requires no authentication or user interaction to exploit. No patch is currently available.
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive embedded data during config import, URI scheme handling, or CLI operations across Windows, macOS, Linux, iOS, Android, and web clients. An unauthenticated remote attacker can exploit this vulnerability without user interaction to extract sensitive configuration information. No patch is currently available for this high-severity vulnerability.
Authenticated peers connected to a Windows RustDesk host running a version before 1.5.0 can bypass the one-way file transfer setting and pull files straight out of the victim's clipboard. Because the same option that is meant to prevent the local machine from serving clipboard files is the one being ignored, an attacker who already holds a valid remote session can send crafted clipboard-redirection messages (FormatDataRequest / FileContentsRequest) and, by supplying the known FileGroupDescriptorW format identifier, receive the contents of any file the user has copied. Rated only 2.3 under CVSS v4.0 (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the issue yields confidentiality impact only, requires an authenticated peer relationship plus a clipboard that already holds files, and no public exploit has been identified at time of analysis.
RustDesk before 1.5.0 on Linux and macOS fails to enforce its own file-transfer permission setting in the Cliprdr clipboard message handler, so an already-connected, authenticated peer whose file-transfer rights have been disabled can still push files onto the host's clipboard and pull back files and clipboard contents from the process-wide clipboard cache. Exploitation is network-reachable but session-gated: the attacker must first hold an authorized peer connection to the target host (CVSS 4.0 base 5.3, PR:L, C:L/I:L per the assessed vector), making this an escalation of an existing restricted session rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available from the upstream RustDesk project.
Path traversal in RustDesk's macOS clipboard file-paste feature allows a remote session peer to write files outside the intended target directory by supplying crafted file descriptor names containing parent-directory components or absolute paths. Versions 1.3.9 through 1.4.9 on macOS are affected; exploitation requires an active RustDesk session and passive victim interaction (initiating a clipboard paste). No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor fix is available via commit 6f1eb164.
RustDesk Server Pro through version 1.7.5 transmits sensitive address book credentials in cleartext over the network heartbeat synchronization API, enabling attackers to intercept and obtain authentication credentials without authentication. The vulnerability affects Windows, macOS, and Linux deployments where the address book sync functionality is enabled. No patch is currently available.
Authentication bypass in RustDesk Client through 1.4.5 across Windows, macOS, Linux, iOS, and Android allows remote attackers to replay captured session IDs and login proofs to impersonate legitimate peers without knowing the original credentials. The flaw stems from insufficient computational effort in the hash_password() routine combined with reusable session identifiers in the login proof construction, enabling capture-replay attacks against the peer authentication module. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.04% (12th percentile).
Privilege escalation in RustDesk Client through version 1.4.5 on Windows, macOS, Linux, iOS, and Android allows unauthenticated remote attackers to abuse API sync and configuration management functions. The vulnerability in the rendezvous mediator and HTTP sync modules enables attackers to gain elevated privileges without user interaction. No patch is currently available for affected users.
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.