Executive brief
RustDesk is a popular open-source remote desktop software used for accessing computers over networks. Versions before 1.4.7 contain a vulnerability that allows unauthenticated attackers to exhaust server memory and cause service outages by sending specially crafted network packets with fraudulent size headers, requiring no user credentials or interaction.
Technical details
The vulnerability is an uncontrolled speculative memory allocation flaw in the BytesCodec decoder component. Before authentication, the decoder trusts a four-byte frame header indicating payload size and pre-allocates that amount of memory without validation, allowing attackers to request up to 1,073,741,823 bytes per connection. By opening multiple concurrent TCP connections and sending crafted headers, an unauthenticated remote attacker can exhaust available memory and cause denial of service. The fix caps header-triggered speculative preallocation at 256 KiB, preventing excessive memory reservation.
Affected products
- RustDesk RustDesk before 1.4.7
Timeline
- 2026-08-26: disclosed
- 2026: patched: Version 1.4.7 and later include the fix capping preallocation at 256 KiB