RustDesk versions prior to 1.5.0 fail to validate that an authenticated remote peer has permission to transfer files through the clipboard, representing an Authority Checking flaw (CWE-862). The Cliprdr message handler on Linux and macOS allows a peer that has file transfer permissions disabled to place files on the host clipboard and retrieve the data from the process‑wide clipboard cache. This makes it possible for a single authenticated user to read or modify files on the host system that the peer should not be allowed to access, exposing confidential data.

The vulnerability affects the RustDesk application (rustdesk:rustdesk) on Linux and macOS platforms for all releases older than version 1.5.0. Known affected commit ranges include 1.4.9 and other pre‑1.5.0 releases.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently widely exploited. Exploitation requires an existing authenticated remote session with the remote side’s file transfer permission disabled; the attacker can then send a file clipboard message to read or write clipboard contents. The impact is primarily confidentiality and possible integrity of data on the host. Overall risk is moderate but mitigation through patching is recommended.