CVE-2026-76840 — CVSS 9.6 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

RustDesk’s Windows clipboard redirection contains an unchecked length field that enables a remote peer to overwrite the heap of any OLE paste consumer, such as explorer.exe, resulting in arbitrary code execution. The vulnerability (CVE‑2026‑76840) carries a CVSS 9.6 score, exposing every organization that deploys RustDesk on Windows to remote compromise without authentication. Immediate decisions are required to approve emergency patching or mitigations, notify affected users, and activate incident response protocols.

Verified Facts

• RustDesk’s Windows clipboard redirection copies a peer‑supplied length into a fixed‑size caller buffer without an upper bound check — source: article.
• The flaw allows a malicious peer to send an oversized CLIPRDR FileContentsResponse, causing out‑of‑bounds writes in the paste consumer’s heap — source: article.
• The same defect was previously identified as CVE‑2026‑68579 in FreeRDP and fixed in FreeRDP 3.30.0 — source: article.
• CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H) and CWE‑20, CWE‑787 are assigned to this vulnerability — source: article.

Threat Classification

Remote code execution via clipboard redirection abuse (T1203 Exploitation for Client Execution) affecting Windows deployments of RustDesk; global geographic scope; exploitation currently theoretical with no public exploit disclosed (MEDIUM CONFIDENCE); attacker motivation inferred as gaining unauthorized execution privileges on victim machines (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: Network‑only vector, no authentication required, low complexity (HIGH CONFIDENCE).
• Impact: Potential full system compromise (confidentiality, integrity, availability) (HIGH CONFIDENCE).
• CVSS score of 9.6 confirms critical severity (HIGH CONFIDENCE).
• Prevalence: RustDesk is widely used for remote support, increasing exposure (MEDIUM CONFIDENCE).

Business Impact

Successful exploitation enables an attacker to execute arbitrary code on any workstation running RustDesk, leading to immediate operational disruption (e.g., ransomware deployment) and potential exfiltration of regulated data, triggering GDPR fines up to €20 million or 4 % of global turnover, and NIS2 penalties for critical‑infrastructure operators. The breach also creates a high‑profile reputational incident, likely resulting in loss of client trust and contract penalties.

Technical Analysis

The attack chain begins when a remote RustDesk peer responds to a clipboard file‑contents request with a CLIPRDR FileContentsResponse whose cbRequested field is maliciously large. The local RustDesk client’s CliprdrStream_Read function forwards this size to CopyMemory without validation, overwriting the heap of the OLE paste consumer (e.g., explorer.exe) that invoked IStream::Read. The root cause is missing upper‑bound validation (CWE‑20) leading to an out‑of‑bounds write (CWE‑787). The vulnerability is present in RustDesk’s Windows clipboard module (libs/clipboard/src/windows/wf_cliprdr.c) and mirrors the defect fixed in FreeRDP 3.30.0 (CVE‑2026‑68579).

CVE Analysis

• CVE‑2026‑76840 — RustDesk (Windows) — CWE‑20, CWE‑787 — Network‑only attack vector, no authentication required — Patch status: not disclosed in article.

MITRE ATT&CK Mapping

• Execution → T1203 Exploitation for Client Execution — the malicious clipboard response triggers arbitrary code execution in the local process.

IOC Intelligence

No public IOCs confirmed at time of publication.

Defensive hunt rules should focus on the following behavioral indicators:

• RustDesk processes handling clipboard data that generate unusually large FileContentsResponse sizes.
• Explorer.exe (or other OLE consumers) invoking IStream::Read with a cb parameter exceeding typical clipboard payloads (e.g., > 1 MB).
• Memory‑corruption alerts from EDR linked to CopyMemory calls originating from RustDesk.
• Network traffic from RustDesk to remote peers containing malformed CLIPRDR protocol fields (oversized length fields).

Detection Engineering Guidance

Log Sources: Sysmon (Event ID 10 Process Access, Event ID 1 Process Create), Windows Security Event Log (Event ID 4663 Object Access on clipboard objects), RustDesk application logs, EDR memory‑corruption alerts.

Detection Logic: Correlate a RustDesk.exe process (or its child) performing a WriteData access on explorer.exe (or any OLE consumer) where the accessed memory size exceeds 1 MB; flag any RustDesk network session that includes a CLIPRDR packet with a length field > 1 MB; alert on EDR signatures for out‑of‑bounds writes triggered by CopyMemory.

Sigma Rules

title: RustDesk Clipboard Oversized FileContentsResponse
id: 3f9c2a1e-5d4b-4a6e-9f2b-8c7d9e1a2b3c
status: stable
description: Detects RustDesk processes delivering a CLIPRDR FileContentsResponse with a size larger than 1 MB, indicating potential exploitation of CVE‑2026‑76840.
author: CYBERDUDEBIVASH Sentinel APEX
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        Image|endswith: '\rustdesk.exe'
        CommandLine|contains: '--clipboard'
    condition: selection and (NetworkPayloadSize > 1048576)
falsepositives:
    - Legitimate large file transfers via RustDesk
level: high
tags:
    - attack.t1203

Threat Hunting Queries

• Identify RustDesk processes that opened a clipboard stream with a requested size > 1 MB — Sysmon Event ID 1, Image = *rustdesk.exe*, CommandLine contains “clipboard”.
• Find Explorer.exe (or any OLE consumer) performing a ReadFile on a clipboard buffer where the byte count > 1 MB — Windows Security Event ID 4663, ObjectName contains “Clipboard”.
• Search for EDR alerts of out‑of‑bounds memory writes originating from rustdesk.exe — EDR alert type = MemoryCorruption, ProcessName = rustdesk.exe.
• Detect network sessions from rustdesk.exe where CLIPRDR protocol length fields exceed 1 MB — Network flow logs, ProcessName = rustdesk.exe, PayloadLength > 1048576.
• Locate any process that called CopyMemory with a source size > 1 MB — Sysmon Event ID 10, TargetImage = explorer.exe, GrantedAccess includes WriteData, SourceImage = rustdesk.exe.

SOC Analyst Playbook

• P0 – Immediate (0‑1 hr): Verify presence of rustdesk.exe processes; isolate affected endpoints; collect memory dump of explorer.exe for forensic analysis.
• P1 – Urgent (1‑4 hr): Query Sysmon and EDR for the hunting queries above; block outbound RustDesk connections at the firewall; apply any available vendor mitigations.
• P2 – Same‑day (≤ 24 hr): Review RustDesk version inventory; schedule emergency patch deployment or rollback to a safe version; update detection rules in SIEM.

Executive Decision Matrix

🔗 Related Intelligence Reports

• Same vulnerability: CVE-2026-68579 — CVSS 9.6 CRITICAL Severity | Patch Required
• Related topic: CVE-2026-78211 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78167 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78168 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78169 — CVSS 9.9 CRITICAL Severity | NVD Vulnerability Record