CVE-2026-100417: RustDesk Information Disclosure Flaw

CVE-2026-100417 Overview

CVE-2026-100417 is an authorization bypass vulnerability in RustDesk versions before 1.5.0 on Windows. The remote desktop software fails to enforce the one-way file transfer configuration against peer-initiated clipboard file requests. Authenticated peers can send crafted FormatDataRequest and FileContentsRequest messages to retrieve files copied to the host clipboard. Exploitation requires the attacker to guess the FileGroupDescriptorW format identifier, which is a predictable value. The flaw is categorized under CWE-862: Missing Authorization and affects the clipboard file transfer handler in the RustDesk server component.

Critical Impact

Authenticated remote peers can exfiltrate files copied to the host clipboard despite administrators enabling the one-way file transfer restriction, leading to unintended data disclosure.

Affected Products

• RustDesk for Windows versions prior to 1.5.0
• RustDesk server component handling clipboard file requests (wf_cliprdr.c)
• Deployments relying on the OPTION_ONE_WAY_FILE_TRANSFER configuration

Discovery Timeline

• 2026-09-25 - CVE-2026-100417 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100417

Vulnerability Analysis

RustDesk provides a one-way file transfer option intended to restrict file movement from the controller to the controlled host. The option prevents the host from sending files to the remote peer. On Windows, the clipboard file transfer code path in libs/clipboard/src/windows/wf_cliprdr.c processes peer requests for clipboard contents without consulting this option. When a connected peer sends a FormatDataRequest for the FileGroupDescriptorW clipboard format followed by FileContentsRequest messages, the host responds with file metadata and contents from its clipboard. This behavior inverts the intended data flow and exposes files the operator copied for local use.

Root Cause

The root cause is missing authorization logic in the clipboard request handler. The server dispatches clipboard file responses before validating whether OPTION_ONE_WAY_FILE_TRANSFER is enabled. The handler in src/ui_cm_interface.rs and the Unix clipboard path similarly lacked a check tying incoming clipboard file requests to the configured file transfer permission.

Attack Vector

An authenticated peer with an established RustDesk session sends standard Remote Desktop Protocol clipboard messages. The attacker issues a FormatDataRequest naming the FileGroupDescriptorW format identifier. The host returns the descriptor for any files currently on its clipboard. The attacker then issues FileContentsRequest messages indexed against the returned descriptor to retrieve each file's bytes. No additional user interaction is required beyond the initial session authentication.

// Security patch adding the authorization check
// Source: https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4
pub fn is_file_data_request(msg: &Cliprdr) -> bool {
    matches!(
        msg.union,
        Some(cliprdr::Union::FormatDataRequest(_)) | Some(cliprdr::Union::FileContentsRequest(_))
    )
}

The companion change in src/server/connection.rs wires the predicate into the request pipeline:

// Source: https://github.com/rustdesk/rustdesk/commit/f299fb9906006247863250d7dfaa016f29eef7a4
} else if is_file_data_request(&clip)
    && crate::get_builtin_option(keys::OPTION_ONE_WAY_FILE_TRANSFER) == "Y"
{
    // One-way file transfer: never serve this side's clipboard files to the peer.
} else if let Some(clip) = msg_2_clip(clip) {
    #[cfg(target_os = "windows")]
    {
        self.send_to_cm(ipc::Data::ClipboardFile(clip));
    }
}

Detection Methods for CVE-2026-100417

Indicators of Compromise

• RustDesk server processes on Windows transmitting clipboard file descriptor payloads to connected peers while OPTION_ONE_WAY_FILE_TRANSFER is set to Y.
• Unexpected outbound file content frames correlated with active RustDesk sessions in network telemetry.
• RustDesk binaries at versions 1.4.9 or earlier remaining installed on hosts after the 1.5.0 release.

Detection Strategies

• Inventory installed RustDesk versions across endpoints and flag any host running a build earlier than 1.5.0.
• Review RustDesk connection logs for sessions that issued clipboard FormatDataRequest messages shortly after connecting.
• Correlate clipboard activity on controlled hosts with file read events to identify files copied by local users and subsequently transmitted.

Monitoring Recommendations

• Monitor the RustDesk configuration file for the one-way-file-transfer option and verify enforcement after upgrades.
• Alert on new or unauthorized RustDesk installations in enterprise environments where remote desktop tools are restricted.
• Track network flows from RustDesk processes for sustained outbound data volumes that exceed expected session overhead.

How to Mitigate CVE-2026-100417

Immediate Actions Required

• Upgrade RustDesk to version 1.5.0 or later on all Windows hosts running the server component.
• Audit endpoints for unmanaged RustDesk installations and remove instances that are not business-sanctioned.
• Instruct operators to clear the system clipboard before accepting incoming RustDesk sessions when running vulnerable builds.

Patch Information

The fix landed in commit f299fb9 via Pull Request 16333. It introduces the is_file_data_request helper and gates clipboard file responses behind the OPTION_ONE_WAY_FILE_TRANSFER setting. Additional context is available in the VulnCheck Advisory.

Workarounds

• Disable the RustDesk clipboard feature entirely in the client configuration where business workflows allow it.
• Restrict RustDesk access with network segmentation so only trusted peers can establish authenticated sessions.
• Train operators to avoid copying sensitive files to the clipboard while a remote session is active on unpatched hosts.

# Verify the installed RustDesk version on Windows endpoints
reg query "HKLM\SOFTWARE\RustDesk" /v Version

# Enforce the one-way file transfer option after upgrading to 1.5.0
# (RustDesk configuration file: %APPDATA%\RustDesk\config\RustDesk2.toml)
# [options]
# one-way-file-transfer = "Y"