Read the docs
TI-2026-64666 Aliases CVE-2026-100417GHSA-wfj5-qqfr-qgmw

RustDesk before 1.5.0 One-Way File Transfer Bypass

Priority LOW 11CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00208 10th percentileScored 2026-11-07
Fix Fixed rustdesk (rustdesk): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustdesk-clientrustdeskbefore 1.5.01.5.0Patch availableCNA
  • rustdesk Vendorrustdesk-client Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA

Remediation

  • Fix · CNA rustdesk (rustdesk) Fixed in 1.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    rustdesk 1.5.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-64661 RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard MessagesPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100417
  2. 2026-10-03 Alias added: GHSA-wfj5-qqfr-qgmw

References

Patch 2

Other 3

  • TI-2024-16591 A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate… CVSS 3.1CRITICAL 9.8
  • TI-2026-23626 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure CVSS 4.0HIGH 8.7
  • TI-2026-23624 RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings CVSS 4.0HIGH 8.3
  • TI-2026-23621 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) CVSS 4.0HIGH 8.2
  • TI-2026-03102 RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption CVSS 4.0HIGH 8.7
  • TI-2026-23629 RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload CVSS 4.0HIGH 8.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences