CVE-2026-76840

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.

• CWE-20
• CWE-787

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m37j-jcr2-8gcc
• https://github.com/rustdesk/rustdesk
• https://github.com/rustdesk/rustdesk/blob/1.4.9/libs/clipboard/src/windows/wf_cliprdr.c
• https://github.com/rustdesk/rustdesk/pull/15515
• https://www.vulncheck.com/advisories/rustdesk-through-heap-buffer-overflow-via-unvalidated-cliprdr-filecontentsresponse-length

Published

Aug 24, 2026

Last Modified

Aug 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76835OAuth2 Proxy honours a client-supplied X-Forwarded-Uri heade…9.1
• CVE-2026-76836AzuraCast exposes the Liquidsoap custom configuration fields…8.8
• CVE-2026-76837Baserow interpolates a user's display name into the rich-tex…6.4
• CVE-2026-76838Hi.Events validates a webhook destination only when it is re…8.5
• CVE-2026-76839Grav before 2.0.16 allows sandboxed Twig templates to access…6.5
• CVE-2026-7684A security vulnerability has been detected in Edimax BR-6428…8.8
• CVE-2026-76841Xinference loads models with Hugging Face remote code execut…8.8
• CVE-2026-76842The Mercado Pago Node.js SDK interpolates caller-supplied id…8.2
• CVE-2026-76843The official Flair wheels for 0.15.0 and 0.15.1 still contai…7.8
• CVE-2026-76844webpack-dev-middleware resolves a request to a local file in…7.4
• CVE-2026-76845adm-zip 0.5.9 through 0.6.0 follows symbolic links at the ex…6.5
• CVE-2026-76846Grav before 2.0.16 contains an incomplete default denylist i…7.5