What’s Vulnerable › Products
rustdesk-client RustDesk Client vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your rustdesk-client RustDesk Client version is affected
Latest rustdesk-client RustDesk Client vulnerabilities
- CVE-2026-100417 — RustDesk before 1.5.0 One-Way File Transfer Bypass (CVSS 3.1)
- CVE-2026-100388 — RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages (CVSS 5.4)
- CVE-2026-73108 — RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec (CVSS 7.5)
- CVE-2026-73102 — RustDesk Path Traversal via macOS Clipboard File-Paste (CVSS 5.7)
- CVE-2026-76840 — RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length (CVSS 9.6)
- CVE-2026-57850 — RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection (CVSS 8.3)
- CVE-2026-58056 — RustDesk - FileTransfer Session Authorization Scope Bypass (CVSS 7.6)
- CVE-2026-30798 — RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload (CVSS 7.5)
- CVE-2026-30797 — RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server (CVSS 8.1)
- CVE-2026-30795 — RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure (CVSS 7.5)
- CVE-2026-30793 — RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation (CVSS 9.8)
- CVE-2026-30792 — RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings (CVSS 8.1)
- CVE-2026-30789 — RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force (CVSS 9.8)
- CVE-2026-30785 — RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) (CVSS 5.5)
- CVE-2026-30783 — RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies (CVSS 9.8)
- CVE-2026-30791 — RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation (CVSS 7.5)
- CVE-2024-25140 — (CVSS 9.8)