Insufficient verification of data authenticity and improper handling of exceptional conditions in the RustDesk Client allow protocol manipulation. The flaw in the heartbeat sync loop and strategy processing modules enables an unauthenticated attacker to send a malicious strategy payload containing a stop‑service command. The client accepts this payload without validating its source or integrity, allowing the attacker to terminate the client process or any associated remote services. The flaw corresponds to CWE‑345 and CWE‑755 and results in a denial of service and potential disruption of remote desktop sessions.

Affected systems include the RustDesk Client for Windows, macOS, Linux, iOS, and Android. The vulnerability affects all versions through 1.4.8. It resides in the heartbeat sync loop and strategy processing modules, particularly the program files src/hbbs_http/sync.rs and the stop-service handler.

With a CVSS score of 8.2, the vulnerability is high severity, yet the EPSS score is below 1 %, indicating a low probability of exploitation at this time. The attack vector is likely remote, requiring the client to establish a connection to a malicious server that sends a crafted strategy payload. The client’s current lack of authentication checks makes the vulnerability exploitable by anyone who can reach the heartbeat sync endpoint. The vulnerability is not listed in the CISA KEV catalog, but administrators should still consider the high CVSS score and potential impact when assessing risk.