CVE-2026-73108
Received Received - Intake

Uncontrolled Speculative Memory Allocation in RustDesk

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connections to cause memory exhaustion and denial of service. The fix caps header-triggered speculative preallocation at 256 KiB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-73108
EUVD
EUVD-2026-66422

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustdesk rustdesk to 1.4.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects RustDesk versions before 1.4.7. It involves an uncontrolled speculative memory allocation flaw in the BytesCodec component. Before authentication, the decoder trusts a four-byte frame header's payload length and reserves memory based on that value. Attackers can craft a header requesting up to 1,073,741,823 bytes, causing memory exhaustion and denial of service via concurrent TCP connections. The fix limits preallocation to 256 KiB.

Detection Guidance

Monitor RustDesk processes for excessive memory usage or crashes. Check network traffic for unusually large payloads in RustDesk connections. Use tools like netstat or ss to inspect active RustDesk TCP connections. Look for connections with abnormally large frame headers.

Impact Analysis

Unauthenticated attackers can exploit this to cause denial of service by exhausting system memory. This may lead to crashes, slowdowns, or unresponsiveness of RustDesk servers or clients. Systems running vulnerable versions are at risk if exposed to untrusted networks.

Mitigation Strategies

Upgrade RustDesk to version 1.4.7 or later immediately. Block or restrict unauthenticated RustDesk connections at the firewall level. Monitor system memory usage for signs of exhaustion. Disable RustDesk services if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart