CVE-2026-100388
RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.
| CWE | CWE-862 |
| Vendor | rustdesk |
| Product | rustdesk |
| Published | Sep 25, 2026 |
| Last Updated | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for rustdesk rustdesk
Be the first to know when new medium vulnerabilities affecting rustdesk rustdesk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
rustdesk / rustdesk
0 < 1.5.0
References
github.com: https://github.com/rustdesk/rustdesk/pull/16333 github.com: https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4 github.com: https://github.com/rustdesk/rustdesk/blob/1.4.9/src/server/connection.rs#L3074-L3092 github.com: https://github.com/rustdesk/rustdesk vulncheck.com: https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-missing-authorization-check-on-incoming-file-clipboard-messages
Credits
White0xdi3