CVE Feed

    Dashboard / CVE / CVE-2026-58056

    CVE-2026-58056

    RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

    Published:Jun 28, 2026
    Last Modified:Jun 29, 2026
    EPS:Jun 28, 2026
    EPSS Score:0.00191
    CVSS Score:7.6

    Affected Products

    Vendor
    Rustdesk
    Product
    Rustdesk

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-73108 (CVSS 8.7) — RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCod…
    CVE-2026-73102 (CVSS 6.9) — RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste…
    CVE-2026-76840 (CVSS 8.5) — RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without…
    CVE-2026-57850 (CVSS 8.7) — RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer g…
    CVE-2026-30785 (CVSS 8.2) — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Has…
    CVE-2026-30783 (CVSS 4.8) — A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, Web…
    CVE-2026-30789 (CVSS 5.7) — Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication …
    CVE-2026-30798 (CVSS 8.2) — Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in r…
    CVE-2026-30797 (CVSS 9.3) — Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linu…
    CVE-2026-30795 (CVSS 8.7) — Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-clie…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High