CVE-2026-73108: high-severity vulnerability in rustdesk
RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.8%
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connections to cause memory exhaustion and denial of service. The fix caps header-triggered speculative preallocation at 256 KiB.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
rustdesk · rustdeskRelated CVEs — rustdesk
In the same product, most dangerous first.
CVE-2026-76840HIGHRustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse LengthEPSS 0.4%CVE-2026-73102MEDIUMRustDesk Path Traversal via macOS Clipboard File-PasteEPSS 0.4%CVE-2026-100417LOWRustDesk before 1.5.0 One-Way File Transfer BypassEPSS 0.2%CVE-2026-100388MEDIUMRustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard MessagesEPSS 0.2%
References
https://github.com/rustdesk/hbb_common/commit/547da54b4ee58eed47163fbd47edb4639e3d88dehttps://github.com/rustdesk/rustdesk/commit/518296f2570d107ad416f29ade5fcce3177f4115https://github.com/rustdesk/rustdesk/releases/tag/1.4.7https://www.vulncheck.com/advisories/rustdesk-uncontrolled-memory-allocation-dos-via-bytescodec