A local attacker who can run low‑privileged code on a Windows system may upload a symbolic link via the Transfer File feature in RustDesk Client. The client processes the link and reads the target file, allowing disclosure of arbitrary files on the host. If the attacker subsequently gains SYSTEM privileges, highly privileged data may be exposed. The weakness is an OS path traversal, classified as CWE‑59.

RustDesk Client for Windows is the affected product. The advisory does not list specific versions, indicating that all unpatched Windows client installations that allow symbolic‑link uploads are vulnerable.

The CVSS score of 5.5 indicates a medium risk level. EPSS is below 1 %, implying a low probability of exploitation in the current landscape. The vulnerability is not included in the CISA KEV catalog. An attacker must first achieve local code execution, limiting the attack surface to individuals with direct access to the machine. Once privilege is gained, arbitrary file reading can occur, potentially compromising sensitive information. The overall risk is moderate but contingent on the presence of local privileged access.