Heap Buffer Overflow in RustDesk's Clipboard Redirection

CVE-2026-76840

What is CVE-2026-76840?

RustDesk's Windows clipboard redirection feature is susceptible to a heap buffer overflow due to improper handling of peer-supplied lengths when copying data. The vulnerability arises when an OLE paste consumer, such as explorer.exe, calls the IStream::Read function with an unchecked buffer length. This oversight permits a malicious peer to supply a response larger than the expected size, resulting in potential writing of attacker-controlled data beyond the bounds of the consumer's heap buffer during clipboard operations. The affected implementation, which derives from FreeRDP's codebase, inherits similar vulnerabilities previously identified and patched in versions beyond FreeRDP 3.30.0.

References