CVE-2026-76840
Received Received - Intake

Buffer Overflow in RustDesk Windows Clipboard Redirection

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76840
EUVD
EUVD-2026-64846

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
rustdesk rustdesk to 3.30.0 (inc)
rustdesk rustdesk 1.4.9
freetdp freetdp 3.29.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76840 is a heap buffer overflow in RustDesk's Windows clipboard redirection feature. When a user pastes clipboard file contents from a remote peer, the application copies a peer-supplied length into a fixed-size buffer without validating the upper bound. A malicious peer can send an oversized response, causing attacker-chosen data to overwrite memory beyond the intended buffer. The issue occurs because the peer's CLIPRDR FileContentsResponse length is used directly without clamping to the expected size, and the only length check happens after the memory copy.

Detection Guidance

Detecting this vulnerability requires inspecting RustDesk's clipboard handling on Windows systems. Check for RustDesk versions prior to 1.4.10 or FreeRDP versions prior to 3.30.0. Monitor for heap corruption or crashes during clipboard file paste operations. Review logs for abnormal memory access patterns in wf_cliprdr.c or related clipboard modules.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code, crash the application, or gain unauthorized access to the system by exploiting the heap buffer overflow. If a user pastes clipboard file contents from a compromised or malicious remote peer, the attacker could overwrite memory in the application or operating system, potentially leading to system compromise or data theft.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. A successful exploit may result in data breaches, unauthorized modifications, or loss of confidentiality, integrity, or availability of sensitive data, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade RustDesk to version 1.4.10 or later and FreeRDP to 3.30.0 or later. Disable clipboard file transfer features if not required. Restrict network access to RustDesk instances. Monitor for suspicious clipboard activity or memory corruption events.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart