# CVE-2026-30798: RustDesk Client Remote Denial of Service in Heartbeat Loop

Source: https://junglewise.ai/threats/cve-2026-30798-rustdesk-client-remote-denial-of-service-in-heartbeat-loop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-30798 · Severity: high · CVSS 7.5 · Published 2026-03-05

RustDesk Client, a remote desktop application used for accessing computers over a network, contains a vulnerability in how it processes server-sent instructions. An attacker who can impersonate or redirect the client to a rogue management server can remotely disable the RustDesk service on the victim's machine. This results in a denial-of-service, preventing legitimate users from accessing the device remotely and potentially disrupting business operations.

Technologies: [Apple Iphone Os](https://junglewise.ai/threats/technologies/iphone-os), [Apple macOS](https://junglewise.ai/threats/technologies/macos), [Google Android](https://junglewise.ai/threats/technologies/android), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows), [Rustdesk](https://junglewise.ai/threats/technologies/rustdesk), [RustDesk Client](https://junglewise.ai/threats/technologies/rustdesk-client). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Google](https://junglewise.ai/threats/vendors/google), [Linux](https://junglewise.ai/threats/vendors/linux), [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [Rustdesk](https://junglewise.ai/threats/vendors/rustdesk).

## Quick answers

**Is CVE-2026-30798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30798 being exploited in the wild.

**How severe is CVE-2026-30798?** High severity, with a CVSS score of 7.5, published 5 March 2026.

**Which products and versions are affected?** RustDesk Client through 1.4.8.

**Is there a fix for CVE-2026-30798?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30798 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-30798?** Check whether you run Apple Iphone Os, Apple macOS, Google Android or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the RustDesk Client's heartbeat synchronization loop and strategy processing modules (specifically src/hbbs_http/sync.rs). The client fails to sufficiently verify the authenticity of 'strategy' payloads received from the API server. An attacker who successfully performs a Man-in-the-Middle (MitM) attack or redirects a client to a rogue API server can inject a 'stop-service' instruction. Because the client merges these unauthenticated strategy options with higher priority than local user settings, it will execute the 'stop-service' handler, leading to a remote denial-of-service. This affects clients on Windows, MacOS, Linux, iOS, and Android.

## Affected products

- RustDesk RustDesk Client through 1.4.8

## Timeline

- 2026-03-05: disclosed: Initial vulnerability discovery and documentation by VULSec Labs
- 2026-06-22: advisory: Updated advisory confirming the vulnerability persists in version 1.4.8

## References

- [https://github.com/rustdesk/rustdesk/releases](https://github.com/rustdesk/rustdesk/releases)
- [https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub](https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub)
- [https://rustdesk.com/docs/en/client/](https://rustdesk.com/docs/en/client/)
- [https://www.vulsec.org/](https://www.vulsec.org/)

## Related threats

- [Google Android Bluetooth buffer overflow in acquireMemory](https://junglewise.ai/threats/cve-2026-95405-in-acquirememory-of-bt-bqr-offload-cc-there-is-a-possible-way-to)
- [ST NFC HAL out-of-bounds write in global memory](https://junglewise.ai/threats/cve-2026-95400-in-stnfc-hal-write-of-hal-st21nfc-cc-there-is-a-possible-way-to)
- [Android HEVC decoder buffer overflow in sub_layer_hrd_parameters](https://junglewise.ai/threats/cve-2026-95397-in-sub-layer-hrd-parameters-of-hevc-decoder-there-is-a-possible)
- [Android framework memory exhaustion in message queue handling](https://junglewise.ai/threats/cve-2026-59632-in-respondreceivedmessage-of-mtsmessagecontroller-cpp-there-is-a)
- [Android use-after-free in UssiController connection listener](https://junglewise.ai/threats/cve-2026-59626-in-sendinfo-of-ussicontroller-cpp-there-is-a-possible-way-to)