CVE-2026-100388 in RustDesk
Summary
by MITRE • 09/25/2026
RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in RustDesk versions prior to 1.5.0 represents a critical failure in access control mechanisms within the Remote Desktop Protocol implementation, specifically affecting the Cliprdr message handler on Linux and macOS operating systems. This flaw stems from an insufficient validation of file transfer permissions when processing incoming clipboard messages. In a properly secured remote desktop environment, administrative controls should strictly enforce user-defined policies regarding data exchange capabilities. However, in this instance, the application fails to verify whether the authenticated remote peer has been explicitly granted permission for file transfers before accepting and processing clipboard operations that involve file data. This oversight allows any connected client, regardless of their assigned privilege level or policy restrictions, to interact with the system's clipboard subsystem without authorization.
From a technical perspective, the vulnerability exploits the way RustDesk handles inter-process communication related to clipboard synchronization. The Cliprdr handler is responsible for translating and forwarding clipboard content between the local machine and the remote session. When an authenticated user connects, they may have certain features disabled via administrative policy, such as file transfer capabilities intended to prevent data exfiltration or unauthorized system interaction. Despite these restrictions being in place at the connection level, the underlying code path that processes incoming clipboard messages does not cross-reference this permission state before allowing operations that write files to the host's clipboard buffer. Consequently, a malicious actor with valid credentials but restricted permissions can bypass these controls by injecting file data into the clipboard stream, effectively circumventing the intended security boundaries established during session initialization.
The operational impact of this vulnerability is significant, particularly in enterprise environments where sensitive information protection and strict access control are paramount. An attacker leveraging this flaw can place arbitrary files onto the host machine's clipboard cache, which may facilitate further attacks such as drive-by downloads or social engineering if those files are subsequently pasted by a user with higher privileges. More critically, the vulnerability allows for data exfiltration through reverse operations; an authenticated remote peer can retrieve and read contents from the process-wide clipboard cache on the host system. This means that any text or file references copied to the local machine's clipboard become accessible to the unauthorized remote session, leading to potential leakage of confidential documents, credentials stored in clipboard history, or other sensitive data intended for internal use only.
This issue aligns with CWE-284, which describes Improper Access Control, as it involves a failure to enforce proper authorization checks before allowing an action that affects system resources. Furthermore, the exploitation technique relates to ATT&CK tactic T1005, specifically subtechnique Data from Local System Clipboard, where adversaries collect data directly from the clipboard of compromised systems for later exfiltration or immediate use in lateral movement and privilege escalation scenarios. The ability to read host clipboard contents effectively turns a standard remote desktop tool into an unintended surveillance mechanism against users who rely on the clipboard for handling sensitive information during their workflow.
To mitigate this vulnerability, organizations running RustDesk must immediately upgrade to version 1.5.0 or later, where the developers have implemented stricter validation logic within the Cliprdr message handler to ensure that file transfer permissions are correctly checked before processing any incoming clipboard data involving files. Until an update can be applied, administrators should consider restricting remote desktop access to only those users who absolutely require it and ensuring that all connections use strong authentication methods such as multi-factor authentication to reduce the risk of credential compromise leading to exploitation. Additionally, monitoring for unusual clipboard activity or unexpected file placements in temporary directories may help detect potential abuse attempts while patching efforts are underway.