Rustdesk vulnerabilities

Products

• Rustdesk 17
• Server 2

Newest

• rustdesk RustDesk before 1.5.0 One-Way File Transfer Bypass CVE-2026-100417 2.3 LowSeptember 25, 2026
• rustdesk RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages CVE-2026-100388 5.3 MediumSeptember 25, 2026
• rustdesk RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec CVE-2026-73108 8.7 HighAugust 26, 2026
• rustdesk RustDesk Path Traversal via macOS Clipboard File-Paste CVE-2026-73102 6.9 MediumAugust 26, 2026
• rustdesk RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length CVE-2026-76840 8.5 HighAugust 2, 2026
• rustdesk RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection CVE-2026-57850 Public exploit 8.7 HighJuly 10, 2026
• rustdesk RustDesk - FileTransfer Session Authorization Scope Bypass CVE-2026-58056 7.2 HighJune 28, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) CVE-2026-30785 8.2 HighMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies CVE-2026-30783 4.8 MediumMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force CVE-2026-30789 5.7 MediumMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload CVE-2026-30798 8.2 HighMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server CVE-2026-30797 9.3 CriticalMarch 5, 2026
• rustdesk server, rustdesk-client rustdesk client +1 more RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync CVE-2026-30796 6.9 MediumMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure CVE-2026-30795 8.7 HighMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation CVE-2026-30793 9.3 CriticalMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings CVE-2026-30792 8.3 HighMarch 5, 2026
• rustdesk, rustdesk-client rustdesk client +1 more RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation CVE-2026-30791 8.7 HighMarch 5, 2026
• rustdesk server, rustdesk-server-pro rustdesk server pro +1 more RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption CVE-2026-3598 8.7 HighMarch 5, 2026
• rustdesk client for windows RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability CVE-2026-2490 5.5 MediumFebruary 20, 2026
• rustdesk A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under... CVE-2024-25140 Disputed 9.8 CriticalFebruary 6, 2024