{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/rustdesk/rustdesk","packageName":"rustdesk","product":"rustdesk","source":"CNA: VulnCheck","vendor":"rustdesk","versions":[{"lessThanOrEqual":"1.4.9","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-76840","cwes":["CWE-787","CWE-20"],"description":"RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.","epss":{"date":"2026-11-08","percentile":0.37821,"score":0.00433},"exploits":[],"kev":null,"metrics":[{"score":8.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:L/SI:H/SA:H","version":"4.0"},{"score":9.6,"severity":"critical","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","version":"3.1"}],"modifiedAt":1794146932577,"publishedAt":1787577118408,"references":[{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/rustdesk/rustdesk"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/rustdesk/rustdesk/blob/1.4.9/libs/clipboard/src/windows/wf_cliprdr.c"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/rustdesk/rustdesk/pull/15515"},{"source":"CNA: VulnCheck","tags":["third-party-advisory","vendor-advisory"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m37j-jcr2-8gcc"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/rustdesk-through-heap-buffer-overflow-via-unvalidated-cliprdr-filecontentsresponse-length"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/rustdesk/rustdesk/pull/15515"}],"revision":"65eb09f6c91439cd2136270cc67d1fbbdd66fa15d43e4f43c074b56e1010aa3e","sources":[{"modifiedAt":1794146932577,"name":"CNA: VulnCheck","retrievedAt":1794151355422,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76840"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794151367992,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76840"}],"ssvc":{"assessedAt":1787588800462,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length","updatedAt":1794151367992}