The vulnerability in RustDesk's Windows clipboard redirection involves copying a peer-supplied length into a fixed-size caller buffer without verifying that the length does not exceed the buffer size. Specifically, when an OLE paste consumer calls IStream::Read, RustDesk requests that many bytes of a remote file and then copies the data using CopyMemory with a size parameter taken directly from the remote peer's FileContentsResponse. The size is never clamped to the caller's buffer size, resulting in a heap buffer overflow if the remote peer supplies an oversized response. This vulnerability is a fork of a similar defect in FreeRDP (CVE-2026-68579) which was fixed in FreeRDP 3.30.0.

An attacker controlling or compromising the remote peer can cause RustDesk to write attacker-chosen data beyond the bounds of a heap buffer in the local paste consumer process. This can lead to memory corruption with potential consequences including code execution, denial of service, or data integrity compromise. The CVSS score of 9.6 reflects the high impact with network attack vector, low attack complexity, no privileges required, user interaction needed, scope change, partial confidentiality loss, high integrity and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid accepting clipboard file contents from untrusted or unknown remote peers. Monitor vendor channels for updates or patches addressing this vulnerability.