What’s Vulnerable › Vulnerabilities

CVE-2026-100388: RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-09-30
• Weakness: CWE-862

Description

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.

Affected products

• rustdesk-client RustDesk Client: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: rustdesk-client RustDesk Client 1.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/rustdesk/rustdesk
• https://github.com/rustdesk/rustdesk/blob/1.4.9/src/server/connection.rs#L3074-L3092
• https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4
• https://github.com/rustdesk/rustdesk/pull/16333
• https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-missing-authorization-check-on-incoming-file-clipboard-messages

Get alerted when CVE-2026-100388 or the next vulnerability affects your stack