CVE-2026-76840 Overview
CVE-2026-76840 is a heap buffer overflow in RustDesk's Windows clipboard redirection code. The flaw lives in CliprdrStream_Read inside libs/clipboard/src/windows/wf_cliprdr.c, where a peer-supplied length from a CLIPRDR FileContentsResponse is copied into a fixed-size caller buffer without an upper bound check. A malicious or compromised RustDesk peer can return an oversized response to a small file-contents read and write attacker-controlled bytes past the end of the paste consumer's heap buffer. RustDesk's file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, and the same defect is tracked as CVE-2026-68579 in FreeRDP, fixed in FreeRDP 3.30.0.
Critical Impact
A remote peer can corrupt heap memory in processes such as explorer.exe when a local user pastes clipboard file contents offered by the attacker.
Affected Products
- RustDesk on Windows (clipboard file-contents redirection path)
- RustDesk 1.4.9 source tree at libs/clipboard/src/windows/wf_cliprdr.c
- Downstream forks of FreeRDP's client/Windows/wf_cliprdr.c prior to FreeRDP 3.30.0
Discovery Timeline
- 2026-08-24 - CVE-2026-76840 published to the National Vulnerability Database (NVD)
- 2026-08-24 - Last updated in NVD
Technical Details for CVE-2026-76840
Vulnerability Analysis
The issue is an input validation failure [CWE-20] in RustDesk's Windows CLIPRDR (Clipboard Virtual Channel Extension) implementation. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read requests cb bytes of a remote file through cliprdr_send_request_filecontents. It then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize). The value req_fsize is written verbatim from the peer's FileContentsResponse by wf_cliprdr_server_file_contents_response using req_fsize = fileContentsResponse->cbRequested, and it is never clamped against cb in the call chain.
The only length check in the function, req_fsize < cb, targets the short-read case and executes after the copy has already run. As a result, an attacker who controls the peer can supply a larger cbRequested than the local buffer size and overflow the paste consumer's heap allocation.
Root Cause
The root cause is missing upper-bound validation between the network-supplied length req_fsize and the caller-provided buffer size cb. CopyMemory trusts the peer-controlled length, and the comparison that could detect the mismatch runs too late.
Attack Vector
The attack requires an active RustDesk clipboard session with file-contents redirection enabled and a local user action to paste clipboard content offered by the remote peer. When the user pastes, the paste consumer issues an IStream::Read for a small buffer. The malicious peer answers with an oversized FileContentsResponse, and RustDesk copies the excess bytes past the heap buffer boundary. Because the write is attacker-controlled in size and content, downstream heap corruption may lead to process crashes or memory tampering in the paste consumer.
No verified public exploit code is available. Refer to the VulnCheck advisory on RustDesk and the upstream FreeRDP GHSA-m37j-jcr2-8gcc advisory for technical details.
Detection Methods for CVE-2026-76840
Indicators of Compromise
- Unexpected crashes of explorer.exe or other OLE paste consumers shortly after clipboard paste operations from a RustDesk session.
- Application error events referencing heap corruption in processes that host RustDesk's clipboard virtual channel.
- RustDesk peer connections from untrusted networks that negotiate CLIPRDR file-contents capabilities.
Detection Strategies
- Hunt for RustDesk client processes on Windows endpoints and correlate their runtime with heap corruption crash telemetry in paste consumer processes.
- Alert on RustDesk sessions initiated from external or unmanaged peers, particularly where clipboard redirection is enabled.
- Inspect Windows Error Reporting (WER) data for faulting modules loaded by processes that consume clipboard data during active remote sessions.
Monitoring Recommendations
- Monitor endpoints for installation of RustDesk builds prior to the fix in pull request #15515.
- Track CLIPRDR virtual channel activity between hosts and log peer identifiers involved in file-contents transfers.
- Enable and centralize crash and exception logs from processes such as explorer.exe to detect exploitation attempts.
How to Mitigate CVE-2026-76840
Immediate Actions Required
- Upgrade RustDesk to a build that incorporates the fix from RustDesk pull request #15515.
- Restrict RustDesk peer connectivity to trusted, authenticated hosts and disable inbound sessions from untrusted networks.
- Disable clipboard file-contents redirection in RustDesk configurations where it is not required.
Patch Information
The defect is remediated upstream in the RustDesk source tree via pull request #15515. The parallel FreeRDP defect CVE-2026-68579 is fixed in FreeRDP 3.30.0 per GHSA-m37j-jcr2-8gcc. Confirm the vulnerable file libs/clipboard/src/windows/wf_cliprdr.c in the deployed RustDesk build matches the patched revision, and verify that req_fsize is clamped against cb before CopyMemory executes.
Workarounds
- Disable clipboard redirection entirely in RustDesk client and server settings until the patched build is deployed.
- Instruct users not to paste clipboard content originating from remote RustDesk peers during untrusted sessions.
- Constrain RustDesk usage to allow-listed peers through network segmentation and firewall rules.
# Example: block inbound RustDesk default ports on Windows until patched
New-NetFirewallRule -DisplayName "Block RustDesk Inbound TCP 21115-21119" -Direction Inbound -Protocol TCP -LocalPort 21115-21119 -Action Block
New-NetFirewallRule -DisplayName "Block RustDesk Inbound UDP 21116" -Direction Inbound -Protocol UDP -LocalPort 21116 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
