The flaw in RustDesk before 1.5.0 permits an authenticated peer to bypass the intended one‑way file transfer restriction. By sending FormatDataRequest and FileContentsRequest messages and guessing the FileGroupDescriptorW format identifier, an attacker can read files that have been copied to the host’s clipboard, resulting in the disclosure of potentially sensitive data. The weakness is a missing authorization check (CWE‑862).

Affected deployments are any Windows installations of RustDesk older than version 1.5.0; all RustDesk builds prior to 1.5.0 inherit this vulnerability. No other operating systems are listed as affected.

The CVSS base score is 2.3, indicating low severity, and there is no EPSS data available. The vulnerability is not currently listed in KEV. Exploitation requires that the attacker already has an authenticated peer connection with the target; the threat model therefore focuses on insider or compromised remote sessions. The flaw leads only to information disclosure and requires local clipboard data, so the overall risk to a broader network is limited, but the risk to the victim’s confidentiality is real.