CVE-2026-100417

RustDesk before 1.5.0 One-Way File Transfer Bypass

State: Published
Severity: 2.3 Low
Published: Sep 25, 2026
Updated: Sep 30, 2026
Reserved: Sep 25, 2026

Description

RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
rustdeskrustdesk	before 1.5.0Affected

References

https://github.com/rustdesk/rustdesk/pull/16333issue-trackingpatch
https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4patch
https://github.com/rustdesk/rustdesk/blob/1.4.9/src/ui_cm_interface.rs#L618-L638technical-description
https://github.com/rustdesk/rustdesk/blob/1.4.9/libs/clipboard/src/windows/wf_cliprdr.c#L2728-L2770technical-description
https://github.com/rustdesk/rustdeskproduct
VulnCheck Advisory: RustDesk before 1.5.0 One-Way File Transfer Bypassthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.