Read the docs
TI-2026-64661 Aliases CVE-2026-100388GHSA-mr3p-q22v-cr79

RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages

Priority LOW 23CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed rustdesk (rustdesk): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustdesk-clientrustdeskbefore 1.5.01.5.0Patch availableCNA
  • rustdesk Vendorrustdesk-client Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA

Remediation

  • Fix · CNA rustdesk (rustdesk) Fixed in 1.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    rustdesk 1.5.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-64666 RustDesk before 1.5.0 One-Way File Transfer BypassPriority LOW 11
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100388
  2. 2026-10-03 Alias added: GHSA-mr3p-q22v-cr79

References

Patch 2

Other 2

  • TI-2024-16591 A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate… CVSS 3.1CRITICAL 9.8
  • TI-2026-23626 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure CVSS 4.0HIGH 8.7
  • TI-2026-23624 RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings CVSS 4.0HIGH 8.3
  • TI-2026-23621 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) CVSS 4.0HIGH 8.2
  • TI-2026-03102 RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption CVSS 4.0HIGH 8.7
  • TI-2026-23629 RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload CVSS 4.0HIGH 8.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences