CVE-2026-100388

Source
https://cve.org/CVERecord?id=CVE-2026-100388
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100388.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100388
Published
2026-09-25T20:13:06Z
Modified
2026-09-27T03:47:23Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages
Details

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.

Database specific
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100388.json"
}
References

Affected packages

Git / github.com/rustdesk/rustdesk

Affected ranges

Type
GIT
Repo
https://github.com/rustdesk/rustdesk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed
Database specific
Show details
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.5.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.1.3
1.1.8
1.1.9
1.2.0
1.2.1
1.2.2
1.2.3
1.2.3-1
1.2.3-2
1.2.4
1.2.5
1.2.6
1.2.7
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
Other
fdroid-version
nightly

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100388.json"