CVE-2026-73102 rustdesk CVE debrief

Who should care

Defenders responsible for RustDesk installations, particularly those using macOS, should assess exposure and prioritize updates. Security teams and vulnerability management teams should review the vulnerability and implement necessary mitigations. Operators and administrators of RustDesk installations should verify and update their systems to prevent potential security risks. Security operations teams should monitor for suspicious file writes outside of '

Why it matters

CVE-2026-73102 is a path traversal vulnerability in RustDesk that allows remote peers to write files outside intended directories. Defenders should verify and update RustDesk installations to prevent potential security risks.

• Potential unauthorized file writes outside intended directories
• Possible data integrity issues
• Required verification of RustDesk installations
• Potential security risks due to unsanitized file descriptor names

Technical summary

The vulnerability exists in the macOS clipboard file-paste code path of RustDesk versions 1.3.9 through 1.4.9. A remote peer can supply file descriptor names that are not normalized, allowing writes outside the intended target directory. The issue is fixed in commit 6f1eb16, which validates descriptor names and safely joins paths. Defenders should prioritize verifying and updating RustDesk installations to prevent potential file writes outside intended directories. The vulnerability allows an attacker to write files at locations writable by the RustDesk process, potentially leading to data integrity issues and security risks.

Defensive priority

Defenders should prioritize verifying and updating RustDesk installations to prevent potential file writes outside intended directories.

Recommended defensive actions

• Verify RustDesk version and update to a fixed version if necessary
• Review and restrict file descriptor names accepted by the application
• Monitor for suspicious file writes outside intended directories
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The issue is fixed in commit 6f1eb16. There are no additional details on exploitation or affected systems beyond the CVE record and NVD entry. Defenders should verify RustDesk installations and review file descriptor names accepted by the application to prevent potential security risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.