CVE-2026-76840 in RustDesk
Summary
by MITRE • 08/24/2026
RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified as CVE-2024-XXXX (referencing the underlying issue also tracked as CVE-2026-68579 in related codebases) represents a critical heap-based buffer overflow within RustDesk's Windows clipboard redirection subsystem. This flaw stems from an improper boundary check during the handling of remote file contents requested via the Clipboard Manager protocol. The vulnerability specifically affects the interaction between the local paste consumer, such as Windows Explorer, and the RustDesk client application when processing data transferred through OLE interfaces. When a user initiates a paste operation for files hosted on a remote machine, the system relies on an IStream interface to retrieve the file contents. The core technical failure occurs within the CliprdrStream_Read function located in libs/clipboard/src/windows/wf_cliprdr.c, which serves as the bridge between the clipboard manager and the underlying data retrieval mechanisms.
The sequence of operations leading to exploitation begins when a peer-supplied length is copied into a fixed-size caller buffer without verifying that this length does not exceed the allocated memory capacity. Specifically, when explorer.exe or another OLE paste consumer invokes IStream::Read with a requested byte count denoted as cb bytes, the RustDesk client responds by requesting those specific bytes from the remote file via cliprdr_send_request_filecontents. The critical defect lies in how the response size is handled. The variable req_fsize is assigned directly from clipboard->req_fdata, which originates from the peer's CLIPRDR FileContentsResponse structure as cbRequested. This value represents the number of bytes the remote side claims to be sending or has sent. Crucially, this value is never clamped or validated against the actual buffer size cb provided by the local consumer before the data copy operation takes place.
The operational impact of this flaw is severe, allowing for arbitrary code execution under specific conditions. The function performs a length comparison using req_fsize < cb to handle short-read scenarios where the remote side sends fewer bytes than requested. However, this validation occurs after the CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize) instruction has already executed. Consequently, if an attacker controls or compromises the remote peer and provides a CLIPRDR FileContentsResponse with a cbRequested value significantly larger than the buffer allocated by the local paste consumer, the system will write data past the end of that heap-allocated buffer. This results in a classic heap-based buffer overflow, corrupting adjacent memory structures such as heap metadata or function pointers. An attacker can leverage this memory corruption to execute arbitrary code with the privileges of the currently logged-in user, potentially leading to full system compromise if elevation of privilege vectors are subsequently exploited.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories including CWE-120: Buffer Copy without Checking Size of Input and CWE-787: Out-of-bounds Write. From a tactical perspective within the MITRE ATT&CK framework, this flaw facilitates initial access or lateral movement through techniques associated with Tactic TA0004: Privilege Escalation and potentially TA0005: Defense Evasion if used to bypass security controls via memory corruption. The root cause is traced back to a fork of FreeRDP's client/Windows/wf_cliprdr.c, indicating that the defect was carried over during code migration or adaptation for RustDesk without adequate remediation of known issues present in the upstream project.
Mitigation strategies must address both immediate operational risks and long-term architectural fixes. The primary recommendation is to apply vendor-provided patches immediately upon release, as this issue has been addressed in FreeRDP version 3.30.0 and should be similarly patched in RustDesk releases that incorporate these updates. Until such a patch is available, organizations should restrict the use of clipboard redirection features for file transfers between untrusted or potentially compromised remote systems. Implementing network segmentation to isolate desktop infrastructure from high-risk networks can reduce the attack surface by preventing direct interaction with malicious peers. Additionally, deploying endpoint detection and response solutions that monitor for anomalous memory access patterns may help detect exploitation attempts in real-time. Developers must enforce strict input validation on all external data sources, ensuring that buffer sizes are always verified against allocation limits before any copy operations occur, thereby eliminating the possibility of out-of-bounds writes driven by attacker-controlled values.