CVE-2026-57850

Name of the Vulnerable Software and Affected Versions RustDesk versions prior to 1.4.9

Description The server fails to enforce the authorized connection scope of a session. This allows a peer with limited session permissions, such as FileTransfer, PortForward, ViewCamera, or Terminal, to send control messages and login options that are intended only for full Remote sessions. An authenticated remote peer can exploit this lack of scope verification to inject out-of-scope control messages, enabling them to observe and control the host beyond their assigned permissions.

Recommendations Update to version 1.4.9 or later.