{"schema_version":"1","data":[{"id":5524,"advisory_id":"b2454648-7d8d-4c3f-8751-745eedc1a499","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76840","source_published_at":"2026-08-24T13:11:58.408+00:00","published_at":"2026-10-24T22:10:00.497635+00:00","extraction_method":"structured","technologies":["core-cve","rustdesk"],"cve_ids":["CVE-2026-76840"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length","summary":"RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.","evidence":"cve:CVE-2026-76840","products":[{"name":{"value":"rustdesk","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-76840","aliases":["CVE-2026-76840"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:L/SI:H/SA:H","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"rustdesk","product":"rustdesk","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.4.9"}],"packageName":"rustdesk","collectionURL":"https://github.com/rustdesk/rustdesk","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:21:11.754Z","provider":"cve","references":["https://github.com/rustdesk/rustdesk","https://github.com/rustdesk/rustdesk/blob/1.4.9/libs/clipboard/src/windows/wf_cliprdr.c","https://github.com/rustdesk/rustdesk/pull/15515","https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m37j-jcr2-8gcc","https://www.vulncheck.com/advisories/rustdesk-through-heap-buffer-overflow-via-unvalidated-cliprdr-filecontentsresponse-length"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76840","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-24T16:26:40.462428Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-24T16:27:03.717Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:21:11.754Z"}}},"related_cves":[{"value":"CVE-2026-76840","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":5474,"advisory_id":"ddcb58fc-c426-450b-b34c-0922ea87b2d8","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73102","source_published_at":"2026-08-26T13:00:00.405+00:00","published_at":"2026-10-24T22:09:29.56664+00:00","extraction_method":"structured","technologies":["core-cve","rustdesk"],"cve_ids":["CVE-2026-73102"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"RustDesk Path Traversal via macOS Clipboard File-Paste","summary":"RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an active clipboard file-paste session can use parent-directory components or absolute paths to write files outside the intended target directory at locations writable by the RustDesk process. Commit 6f1eb16 fixes the issue by validating descriptor names and safely joining paths.","evidence":"cve:CVE-2026-73102","products":[{"name":{"value":"rustdesk","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-73102","aliases":["CVE-2026-73102"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.7,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rustdesk/rustdesk","vendor":"rustdesk","product":"rustdesk","versions":[{"status":"affected","version":"1.3.9","versionType":"semver","lessThanOrEqual":"1.4.9"},{"status":"unaffected","version":"6f1eb164d616e0e2bfbcf8c6b7c8083b09d7ed06","versionType":"git"}],"packageURL":"pkg:github/rustdesk/rustdesk","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:20:30.087Z","provider":"cve","references":["https://github.com/rustdesk/rustdesk/pull/15693","https://github.com/rustdesk/rustdesk/commit/6f1eb164d616e0e2bfbcf8c6b7c8083b09d7ed06","https://www.vulncheck.com/advisories/rustdesk-path-traversal-via-macos-clipboard-file-paste"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-73102","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-26T13:54:00.719832Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-26T13:54:10.076Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:30.087Z"}}},"related_cves":[{"value":"CVE-2026-73102","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":5472,"advisory_id":"bf2cd973-a564-4677-9916-f97d1cdde591","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73108","source_published_at":"2026-08-26T13:00:29.283+00:00","published_at":"2026-10-24T22:09:28.397322+00:00","extraction_method":"structured","technologies":["core-cve","rustdesk"],"cve_ids":["CVE-2026-73108"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec","summary":"RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connections to cause memory exhaustion and denial of service. The fix caps header-triggered speculative preallocation at 256 KiB.","evidence":"cve:CVE-2026-73108","products":[{"name":{"value":"rustdesk","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-73108","aliases":["CVE-2026-73108"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rustdesk/rustdesk","vendor":"rustdesk","product":"rustdesk","versions":[{"status":"affected","version":"0","lessThan":"1.4.7","versionType":"semver"}],"packageURL":"pkg:github/rustdesk/rustdesk","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:20:30.744Z","provider":"cve","references":["https://github.com/rustdesk/rustdesk/releases/tag/1.4.7","https://github.com/rustdesk/hbb_common/commit/547da54b4ee58eed47163fbd47edb4639e3d88de","https://github.com/rustdesk/rustdesk/commit/518296f2570d107ad416f29ade5fcce3177f4115","https://www.vulncheck.com/advisories/rustdesk-uncontrolled-memory-allocation-dos-via-bytescodec"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-73108","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-28T22:49:20.162444Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-28T22:49:32.867Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:30.744Z"}}},"related_cves":[{"value":"CVE-2026-73108","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4073,"advisory_id":"a1c9934a-b418-4465-9240-ed75d8a652ca","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100417","source_published_at":"2026-09-25T20:25:18.041+00:00","published_at":"2026-10-24T21:45:36.750552+00:00","extraction_method":"structured","technologies":["core-cve","rustdesk"],"cve_ids":["CVE-2026-100417"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"RustDesk before 1.5.0 One-Way File Transfer Bypass","summary":"RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.","evidence":"cve:CVE-2026-100417","products":[{"name":{"value":"rustdesk","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-100417","aliases":["CVE-2026-100417"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2.3,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"rustdesk","product":"rustdesk","versions":[{"status":"affected","version":"0","lessThan":"1.5.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T00:09:30.175Z","provider":"cve","references":["https://github.com/rustdesk/rustdesk/pull/16333","https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4","https://github.com/rustdesk/rustdesk/blob/1.4.9/src/ui_cm_interface.rs#L618-L638","https://github.com/rustdesk/rustdesk/blob/1.4.9/libs/clipboard/src/windows/wf_cliprdr.c#L2728-L2770","https://github.com/rustdesk/rustdesk","https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-one-way-file-transfer-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100417","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T00:09:19.998405Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T00:09:30.175Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-25T20:25:18.041Z"}}},"related_cves":[{"value":"CVE-2026-100417","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4071,"advisory_id":"cc6f5280-c917-40e3-8105-9a6525ccdeff","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100388","source_published_at":"2026-09-25T20:13:06.546+00:00","published_at":"2026-10-24T21:45:35.40622+00:00","extraction_method":"structured","technologies":["core-cve","rustdesk"],"cve_ids":["CVE-2026-100388"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages","summary":"RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.","evidence":"cve:CVE-2026-100388","products":[{"name":{"value":"rustdesk","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100388","aliases":["CVE-2026-100388"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"rustdesk","product":"rustdesk","versions":[{"status":"affected","version":"0","lessThan":"1.5.0","versionType":"semver"},{"status":"unaffected","version":"1.5.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T00:08:08.572Z","provider":"cve","references":["https://github.com/rustdesk/rustdesk/pull/16333","https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4","https://github.com/rustdesk/rustdesk/blob/1.4.9/src/server/connection.rs#L3074-L3092","https://github.com/rustdesk/rustdesk","https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-missing-authorization-check-on-incoming-file-clipboard-messages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100388","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T00:07:58.490575Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T00:08:08.572Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-25T20:25:13.834Z"}}},"related_cves":[{"value":"CVE-2026-100388","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":5524,"next_before":4071}