Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100417— RustDesk before 1.5.0 One-Way File Transfer Bypass

Quick assessment

Affected
rustdesk rustdesk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Windows 平台上，RustDesk 1.5.0 之前的版本未能对“单向文件传输”选项进行正确强制限制，以抵御对端发起的剪贴板文件请求。这导致经过身份验证的对端可以从宿主机的剪贴板中读取文件内容。攻击者可通过猜测 FileGroupDescriptorW 格式标识符，发送 FormatDataRequest 和 FileContentsRequest 消息，从而窃取已复制的文件。

CVSS 3.1 · Low EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1115 · Clipboard Data

Affected Version Matrix 1

VendorProduct Version RangeStatus
rustdesk rustdesk < 1.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100417

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RustDesk before 1.5.0 One-Way File Transfer Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
rustdesk rustdesk 0 ~ 1.5.0 -

II. Public POCs for CVE-2026-100417

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100417

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-100417 (2)

Vendor Advisories for CVE-2026-100417 (1)

Vendor Pages for CVE-2026-100417 (1)

IV. Related Vulnerabilities

Same product: rustdesk
Same vendor: rustdesk
Same weakness: CWE-862

V. Comments for CVE-2026-100417

No comments yet

Leave a comment