Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2026-100417: RustDesk Windows before 1.5 allows file read via clipboard
CVE-2026-100417 · published 24 days ago
Summary
In versions of RustDesk for Windows prior to 1.5, the program does not stop a connected remote user from requesting files that were placed on the host's clipboard. This means an authenticated remote user could retrieve those files without permission. Upgrade to RustDesk 1.5 or later and avoid copying sensitive documents to the clipboard during remote sessions.
Original advisory text
RustDesk before 1.5.0 One-Way File Transfer Bypass
RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.
References
- https://github.com/rustdesk/rustdesk
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1004... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100417 Vendor Advisory
- https://github.com/rustdesk/rustdesk/blob/1.4.9/libs/clipboard/src/windows/wf_cl...
- https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29ee...
- https://github.com/rustdesk/rustdesk/pull/16333
- https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-one-way-file-transfer...
- https://github.com/rustdesk/rustdesk/blob/1.4.9/src/ui_cm_interface.rs#L618-L638
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published25 Sep 2026
Updated19 Oct 2026
First seen25 Sep 2026
Track software like this
Free during beta