PT-2026-23466 · Unknown · Rustdesk Client

Erez Kalman · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-30785

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description The RustDesk Client software contains issues related to improperly controlled modification of object prototype attributes ('Prototype Pollution') and the use of a password hash with insufficient computational effort. These issues potentially allow for the retrieval of embedded sensitive data. The problems are associated with program files including hbb common/src/password security.Rs, hbb common/src/config.Rs, hbb common/src/lib.Rs (specifically the get uuid routine), and machine-uid/src/lib.Rs. The affected program routines include symmetric crypt(), encrypt str or original(), decrypt str or original(), and get machine id().

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-257

CWE-916

CWE-323

CWE-1321

Related Identifiers

CVE-2026-30785

Affected Products

Rustdesk Client

References · 7

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30785 · Security Note
• https://github.com/rustdesk/rustdesk/discussions/9229 · Note
• https://github.com/rustdesk/rustdesk/discussions/4979 · Note
• https://twitter.com/CVEnew/status/2029654727122690228 · Twitter Post
• https://vulsec.org · Note
• https://twitter.com/VulmonFeeds/status/2029628165597888773 · Twitter Post