File Transfer Vulnerability in RustDesk for Windows
CVE-2026-100417

2.3LOW

Key Information:

Vendor

Rustdesk

Status
Rustdesk
Vendor
CVE Published:
25 September 2026

What is CVE-2026-100417?

RustDesk versions prior to 1.5.0 on Windows have a vulnerability that fails to properly enforce the one-way file transfer feature against requests made by authenticated peers. This oversight allows an attacker to exploit clipboard file requests, leading to potential unauthorized access to sensitive files copied in the user's clipboard. By sending specific messages, such as FormatDataRequest and FileContentsRequest, attackers can bypass intended restrictions and retrieve files that should not be accessible.

Affected Version(s)

rustdesk 0 < 1.5.0

References

https://github.com/rustdesk/rustdesk/pull/16333
issue-trackingpatch
https://github.com/rustdesk/rustdesk/commit/f299fb9906006...
patch
https://github.com/rustdesk/rustdesk/blob/1.4.9/src/ui_cm...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

RustDesk
.