CVEvulnerability
CVE-2026-100388
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-25
- Last modified
- 2026-09-30
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-862
Description
RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/rustdesk/rustdesk github.com
- https://github.com/rustdesk/rustdesk/blob/1.4.9/src/server/connection.rs#L3074-L3092 github.com
- https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4 github.com
- https://github.com/rustdesk/rustdesk/pull/16333 github.com
- https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-missing-authorization-check-on-incoming-file-clipboard-messages www.vulncheck.com