Insufficient verification of data authenticity in the RustDesk Client allows an unauthenticated user to send a malicious strategy payload that triggers the stop-service handler. Because the client accepts the payload without validating its source or integrity, an attacker can terminate the client process or any related remote services. This flaw corresponds to CWE‑345 (broken authentication) and CWE‑755 (improper handling of exceptional conditions), and results in a denial of service and potential disruption of remote desktop sessions.

Affected systems include the RustDesk Client for Windows, macOS, Linux, iOS, and Android running version 1.4.5 or earlier. The vulnerability resides in the heartbeat sync loop and strategy processing modules, particularly in src/hbbs_http/sync.rs and the stop-service routine.

With a CVSS score of 8.2, the vulnerability is high severity, yet the EPSS score is below 1 %, indicating a low probability of exploitation at this time. The attack vector is likely remote, requiring the client to establish a connection to a malicious server that sends a crafted strategy payload. The client’s current lack of authentication checks makes the vulnerability exploitable by anyone who can reach the heartbeat sync endpoint. The vulnerability is not listed in the CISA KEV catalog, but administrators should still consider the high CVSS score and potential impact when assessing risk.