Executive brief
RustDesk's remote desktop clipboard sharing feature on Windows contains a heap buffer overflow vulnerability in how it handles clipboard file contents from remote peers. When a user pastes files offered by a remote desktop session, a malicious or compromised remote peer can send oversized clipboard data that overflows the buffer in the local system process (such as Windows Explorer), potentially enabling arbitrary code execution with the privileges of that process.
Technical details
The vulnerability is an out-of-bounds write (CWE-787) in the CliprdrStream_Read function in libs/clipboard/src/windows/wf_cliprdr.c. When a local OLE consumer (e.g., explorer.exe) requests clipboard file contents via IStream::Read with a fixed buffer size, RustDesk forwards a bounded request to the remote peer. However, the response handler (wf_cliprdr_server_file_contents_response) copies the peer-supplied response length directly into req_fsize without clamping it to the caller's buffer size. The subsequent CopyMemory operation copies req_fsize bytes into a cb-byte buffer, causing a heap overflow with attacker-controlled data. The attack requires a malicious or compromised RDP/clipboard peer and occurs when the local user attempts to paste remote clipboard file contents. This is a direct port of the same vulnerability in FreeRDP (CVE-2026-68579), fixed in FreeRDP 3.30.0.
Affected products
- RustDesk RustDesk <UNKNOWN>
Timeline
- 2026-08-24: disclosed