Uncontrolled Speculative Memory Allocation in RustDesk

CVE-2026-73108

What is CVE-2026-73108?

RustDesk versions prior to 1.4.7 exhibit a vulnerability in the BytesCodec component, where an attacker can exploit the payload length in a misleading four-byte header to allocate excessive memory. This could lead to memory exhaustion, enabling denial of service attacks through simultaneous TCP connections. The vulnerability has been addressed by limiting the preallocated memory cap to 256 KiB.

References