Quick answers
- Is CVE-2026-76840 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76840 being exploited in the wild.
- How severe is CVE-2026-76840?
- Critical severity, with a CVSS score of 9.6, published 24 August 2026.
- Which products and versions are affected?
- Rustdesk <UNKNOWN>.
- Is there a fix for CVE-2026-76840?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76840 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-76840?
- Check whether you run Rustdesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an out-of-bounds write (CWE-787) in the CliprdrStream_Read function in libs/clipboard/src/windows/wf_cliprdr.c. When a local OLE consumer (e.g., explorer.exe) requests clipboard file contents via IStream::Read with a fixed buffer size, RustDesk forwards a bounded request to the remote peer. However, the response handler (wf_cliprdr_server_file_contents_response) copies the peer-supplied response length directly into req_fsize without clamping it to the caller's buffer size. The subsequent CopyMemory operation copies req_fsize bytes into a cb-byte buffer, causing a heap overflow with attacker-controlled data. The attack requires a malicious or compromised RDP/clipboard peer and occurs when the local user attempts to paste remote clipboard file contents. This is a direct port of the same vulnerability in FreeRDP (CVE-2026-68579), fixed in FreeRDP 3.30.0.
Affected products
- RustDesk RustDesk <UNKNOWN>
Timeline
- 2026-08-24: disclosed