RustDesk’s Windows clipboard redirection code copies a peer‑supplied length into a fixed‑size buffer without an upper bound check. When a remote client responds to a file‑contents request with a length larger than the buffer supplied by the OLE paste consumer, the code performs an unchecked CopyMemory that writes past the end of that buffer. This produces an out‑of‑bounds write in heap memory that can corrupt adjacent data and potentially lead to application crashes or other unpredictable behavior.

The flaw affects RustDesk versions through 1.4.9 that include the original clipboard handling implementation. Users running RustDesk 1.4.9 on Windows are vulnerable unless they have applied a patch from a newer release. All 1.4.x releases prior to the fix remain impacted.

The vulnerability carries a CVSS base score of 8.5, indicating a high severity. EPSS data is not available, but the flaw can be triggered by any active remote session that supplies an oversized file‑contents response during clipboard paste activity. The risk is elevated in environments that allow untrusted remote connections. The issue is not listed in the CISA KEV catalog, but that does not alter the potential impact if an attacker controls the remote session.