# CVE-2026-73108: RustDesk uncontrolled memory allocation in BytesCodec

Source: https://junglewise.ai/threats/cve-2026-73108-rustdesk-uncontrolled-memory-allocation-in-bytescodec  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73108 · Severity: high · CVSS 7.5 · Published 2026-08-26

RustDesk is a popular open-source remote desktop software used for accessing computers over networks. Versions before 1.4.7 contain a vulnerability that allows unauthenticated attackers to exhaust server memory and cause service outages by sending specially crafted network packets with fraudulent size headers, requiring no user credentials or interaction.

Technologies: [Rustdesk](https://junglewise.ai/threats/technologies/rustdesk). Vendors: [Rustdesk](https://junglewise.ai/threats/vendors/rustdesk).

## Quick answers

**Is CVE-2026-73108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73108 being exploited in the wild.

**How severe is CVE-2026-73108?** High severity, with a CVSS score of 7.5, published 26 August 2026.

**Which products and versions are affected?** Rustdesk before 1.4.7.

**Is there a fix for CVE-2026-73108?** A patch was published on 2026: Version 1.4.7 and later include the fix capping preallocation at 256 KiB Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73108 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73108?** Check whether you run Rustdesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an uncontrolled speculative memory allocation flaw in the BytesCodec decoder component. Before authentication, the decoder trusts a four-byte frame header indicating payload size and pre-allocates that amount of memory without validation, allowing attackers to request up to 1,073,741,823 bytes per connection. By opening multiple concurrent TCP connections and sending crafted headers, an unauthenticated remote attacker can exhaust available memory and cause denial of service. The fix caps header-triggered speculative preallocation at 256 KiB, preventing excessive memory reservation.

## Affected products

- RustDesk RustDesk before 1.4.7

## Timeline

- 2026-08-26: disclosed
- 2026: patched: Version 1.4.7 and later include the fix capping preallocation at 256 KiB

## References

- [https://github.com/rustdesk/hbb_common/commit/547da54b4ee58eed47163fbd47edb4639e3d88de](https://github.com/rustdesk/hbb_common/commit/547da54b4ee58eed47163fbd47edb4639e3d88de)
- [https://github.com/rustdesk/rustdesk/commit/518296f2570d107ad416f29ade5fcce3177f4115](https://github.com/rustdesk/rustdesk/commit/518296f2570d107ad416f29ade5fcce3177f4115)

## Related threats

- [RustDesk file transfer permission bypass in Cliprdr handler](https://junglewise.ai/threats/cve-2026-100388-rustdesk-versions-before-1-5-0-fail-to-properly-validate-file)
- [RustDesk path traversal in macOS clipboard file-paste](https://junglewise.ai/threats/cve-2026-73102-rustdesk-path-traversal-in-macos-clipboard-file-paste)
- [RustDesk Windows clipboard redirection buffer overflow](https://junglewise.ai/threats/cve-2026-76840-rustdesk-windows-clipboard-redirection-buffer-overflow)
- [RustDesk missing authorization in session scope enforcement](https://junglewise.ai/threats/cve-2026-57850-rustdesk-missing-authorization-in-session-scope-enforcement)
- [RustDesk authorization bypass in FileTransfer session](https://junglewise.ai/threats/cve-2026-58056-rustdesk-authorization-bypass-in-filetransfer-session)