CVE-2026-73108: RustDesk Memory Exhaustion DOS Vulnerability

CVE-2026-73108 Overview

CVE-2026-73108 is an uncontrolled speculative memory allocation vulnerability in RustDesk versions before 1.4.7. The flaw resides in the BytesCodec decoder within the hbb_common library. Before authentication completes, the decoder trusts the payload length encoded in a four-byte frame header and reserves that capacity in memory before receiving any payload bytes. A crafted header can request up to 1,073,741,823 bytes of capacity per connection. Unauthenticated attackers can open concurrent TCP connections to trigger memory exhaustion and denial of service. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

Critical Impact
Unauthenticated remote attackers can exhaust host memory on RustDesk deployments, taking the remote-access service offline through concurrent malformed TCP connections.

Affected Products

RustDesk versions prior to 1.4.7
hbb_common library used by RustDesk (BytesCodec decoder)
Any RustDesk server or client exposing the affected TCP listener to untrusted networks

Discovery Timeline

2026-08-26 - CVE-2026-73108 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-73108

Vulnerability Analysis

RustDesk uses the BytesCodec decoder from hbb_common to frame TCP messages. Each frame begins with a four-byte header that encodes the length of the upcoming payload. The decoder reads this header and calls reserve() on its internal buffer to preallocate space for the incoming data. Because this preallocation occurs before authentication and before the payload arrives, an attacker only needs to send the four-byte header to force a large memory allocation. The header encodes a length field capable of requesting nearly 1 GiB per connection. Repeated concurrent connections multiply this allocation and drive the RustDesk process into memory exhaustion.

Root Cause

The decoder trusts attacker-controlled length metadata without applying an upper bound. The reserve() call speculatively expands the buffer to match the announced payload size, regardless of whether the peer ever sends the corresponding bytes. No authentication, rate limit, or size cap gates this allocation path.

Attack Vector

The attack is network-reachable and requires no privileges or user interaction. An attacker connects to the RustDesk TCP listener, sends a crafted four-byte header advertising a payload near the maximum size, and holds the connection open. Repeating this across many parallel sockets drives resident memory upward until the operating system kills the process or the host becomes unresponsive.

rust

 use std::io;
 use tokio_util::codec::{Decoder, Encoder};
 
+// Bound speculative allocation from untrusted frame headers.
+const MAX_PREALLOCATED_PAYLOAD_LEN: usize = 256 * 1024;
+
 #[derive(Debug, Clone, Copy)]
 pub struct BytesCodec {
     state: DecodeState,

Source: rustdesk/hbb_common commit 547da54. The patch introduces MAX_PREALLOCATED_PAYLOAD_LEN set to 256 KiB, capping the speculative reserve() call so header-driven allocation cannot exceed that bound.

Detection Methods for CVE-2026-73108

Indicators of Compromise

Sudden growth in resident memory of the rustdesk or hbbs/hbbr process without a matching increase in active session count
Numerous concurrent TCP connections to the RustDesk listener from a small set of source addresses
Short-lived TCP sessions that transmit only four bytes before stalling or closing

Detection Strategies

Monitor process memory metrics for RustDesk services and alert on rapid RSS growth outside normal operating baselines
Inspect network telemetry for connections that complete a TCP handshake but never advance past the initial header exchange
Correlate OOM-killer events or service restarts on hosts running RustDesk with concurrent inbound TCP traffic spikes

Monitoring Recommendations

Enable connection-rate logging on firewalls or reverse proxies in front of RustDesk listeners
Track version strings of deployed RustDesk instances and flag any running a release earlier than 1.4.7
Log and review repeated service crashes or automatic restarts of RustDesk components as potential DoS indicators

How to Mitigate CVE-2026-73108

Immediate Actions Required

Upgrade all RustDesk clients and self-hosted servers to version 1.4.7 or later
Restrict exposure of RustDesk TCP listeners to trusted networks or VPN segments until patching completes
Apply connection-rate limits at the network edge to reduce the impact of concurrent malformed connections

Patch Information

The fix is delivered in the RustDesk 1.4.7 release and lands via hbb_common commit 547da54 and rustdesk commit 518296f. The patch caps header-triggered speculative preallocation at 256 KiB in src/bytes_codec.rs. Additional context is available in the VulnCheck advisory.

Workarounds

Place RustDesk behind a firewall or reverse proxy that enforces per-source connection limits and idle-connection timeouts
Constrain the RustDesk process with operating-system memory limits (for example, systemdMemoryMax= or container memory caps) so exhaustion is contained
Deny direct internet exposure of the RustDesk TCP ports and require VPN or zero-trust access until version 1.4.7 is deployed

bash

# Example: constrain RustDesk memory with systemd until patched
# /etc/systemd/system/rustdesk-hbbs.service.d/override.conf
[Service]
MemoryMax=1G
MemoryHigh=768M
TasksMax=512