CVE Feed

    Dashboard / CVE / CVE-2026-100388

    CVE-2026-100388

    RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.

    Published:Sep 25, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 25, 2026
    EPSS Score:0.00177
    CVSS Score:5.4

    Affected Products

    Vendor
    Rustdesk
    Product
    Rustdesk

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-100417 (CVSS 2.3) — RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file…
    CVE-2026-73108 (CVSS 8.7) — RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCod…
    CVE-2026-73102 (CVSS 6.9) — RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste…
    CVE-2026-76840 (CVSS 8.5) — RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without…
    CVE-2026-57850 (CVSS 8.7) — RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer g…
    CVE-2026-58056 (CVSS 7.2) — RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized conne…
    CVE-2026-30785 (CVSS 8.2) — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Has…
    CVE-2026-30783 (CVSS 4.8) — A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, Web…
    CVE-2026-30789 (CVSS 5.7) — Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication …
    CVE-2026-30798 (CVSS 8.2) — Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High