CVE-2026-100417 in RustDesk
Summary
by MITRE • 09/25/2026
RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in RustDesk versions prior to 1.5.0 represents a critical failure in access control mechanisms within the remote desktop protocol implementation on Windows systems. This flaw specifically affects the file transfer functionality, where the application is designed to support one-way file transfers from host to peer or vice versa based on explicit user consent and configuration settings. However, due to insufficient validation of incoming messages, an authenticated attacker operating as a peer can bypass these restrictions by directly interacting with the clipboard subsystem through crafted network packets. The core technical flaw lies in the server-side handling of clipboard-related requests, where the application fails to verify whether the requested operation aligns with the configured security policy for file transfers. Instead of strictly enforcing the one-way constraint, the software processes specific format data and file content requests that allow it to extract information from the host system's clipboard buffer without proper authorization checks or user interaction prompts.
From a technical perspective, this vulnerability exploits the way RustDesk interfaces with Windows API functions related to clipboard management. When an authenticated peer initiates communication, they can send FormatDataRequest messages to query available data formats on the host clipboard and subsequently issue FileContentsRequest messages to retrieve the actual file contents. The attacker leverages knowledge of standard Windows clipboard format identifiers, specifically targeting the FileGroupDescriptorW structure which is commonly used for transferring files via drag-and-drop operations or copy-paste actions. By guessing this specific format identifier, the malicious peer can trick the RustDesk server into reading and transmitting sensitive data that was previously copied to the host's clipboard by legitimate users. This process does not require any additional privileges beyond those granted during initial authentication, making it particularly dangerous in environments where remote sessions are established with standard user credentials but involve access to systems containing confidential information.
The operational impact of this vulnerability is severe, as it effectively neutralizes a key security feature intended to protect data privacy during remote desktop sessions. Users who rely on the one-way file transfer option assume that their clipboard contents remain isolated from the peer unless explicitly shared through approved channels. With this flaw present, any sensitive documents, credentials, or proprietary information copied by the host user can be silently exfiltrated by an attacker with valid session access. This undermines trust in remote desktop solutions and poses significant risks for organizations handling regulated data such as financial records, healthcare information, or intellectual property. The ability to read clipboard contents remotely also facilitates further attacks, including credential harvesting if passwords are copied during administrative tasks, thereby expanding the attack surface beyond simple file theft into broader system compromise scenarios.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-1065 Unanticipated Input State Change as defined by common weakness enumerations standards. It also maps to MITRE ATT&CK technique T1005 Data from Local System which describes methods for collecting data directly from an infected computer, specifically through clipboard access mechanisms. Additionally, the exploitation method involving guessing format identifiers relates to CWE-209 Generation of Error Message Containing Sensitive Information if error responses inadvertently leak structural details that aid in further enumeration attacks. To mitigate this risk, organizations must immediately upgrade RustDesk installations on Windows systems to version 1.5.0 or later where these access control checks have been properly implemented and enforced. Until patching is complete, administrators should restrict remote desktop sessions to trusted networks only, enforce multi-factor authentication for all user accounts, and monitor session logs for unusual clipboard activity patterns that may indicate exploitation attempts.