RustDesk versions prior to 1.4.7 suffer an uncontrolled speculative memory allocation flaw in the BytesCodec component. The decoder blindly trusts a four‑byte frame header that specifies the payload length and reserves that amount of memory before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing attackers without authentication to drain the server’s memory by opening multiple TCP connections simultaneously. The resulting memory exhaustion stops the application from accepting new connections or responding to legitimate users, causing a denial‑of‑service condition. The vulnerability does not expose data or alter the integrity of the system, affecting only availability.

The affected product is RustDesk. All installations running any version older than 1.4.7 are vulnerable. The issue was fixed in the 1.4.7 release, which limits speculative pre‑allocation to 256 KiB.

The CVSS score of 8.7 classifies this vulnerability as high severity. The EPSS score is unavailable, but the absence of a KEV listing indicates the exploit is not yet widely reported. The flaw can be leveraged by an unauthenticated attacker who establishes concurrent TCP connections to the RustDesk service and sends a malicious frame header, triggering uncontrolled memory allocation. The attack surface is the network layer; no special credentials are required, making it amenable to automated or remote exploitation.