RustDesk FileTransfer session authorization scope bypass allowing input injection and screen capture

RustDesk authorizes a remote session as one of several connection *types* — view-only, file-transfer, full control — but its message dispatcher checks per-capability bitflags on the inbound control stream instead of asking *what kind of session is this?* A peer who only negotiated FileTransfer still has the keyboard, mouse, screenshot, and display-capture handlers reachable because those capability flags are never cleared at session setup. Once the peer is authorized for file moves, it can call mouse_event, key_event, and the screen-grab routines and the server happily honors them. Affected: RustDesk through commit ff226f6d8013dee2de5a6553abaf67bf32b3e875 (disclosed 2026-06-28, CWE-863, fix not yet pinned to a tagged release at time of writing).

Vendor severity of HIGH (7.6) is defensible on paper but a touch hot for the typical deployment. CVSS captures the I:H from synthesized input and C:L from screen capture, but it bakes in PR:L — the attacker must *already* hold a valid FileTransfer authorization. That precondition is the whole story: if you never share a FileTransfer-scoped permanent password or accept a file-transfer prompt from a stranger, the chain never starts. We land MEDIUM for most fleets — confidentiality + integrity *to the single endpoint* the attacker was already granted partial access to, with no lateral pivot and no unauth RCE.

Sources.

1. NVD — CVE-2026-58056
2. VulnCheck advisory — RustDesk FileTransfer Session Authorization Scope Bypass
3. GHSA-vp3r-hwqm-x826 (CIRCL mirror)
4. PoC — bikini/exploitarium (rustdesk-session-permission-pocs)
5. RustDesk upstream repository
6. RedPacket Security — CVE alert
7. CIRCL Vulnerability Lookup — CVE-2026-58056
8. FIRST EPSS model

Run on each Windows endpoint you suspect has RustDesk installed. Invoke from an admin PowerShell session: .\Check-RustDeskCVE-2026-58056.ps1. Requires local admin to read Program Files and the per-user config. Output is VULNERABLE, PATCHED, or UNKNOWN per host with the detected version/commit.

#requires -Version 5.1
# Check-RustDeskCVE-2026-58056.ps1
# Detects RustDesk installs vulnerable to the FileTransfer authorization scope bypass.
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN/NOT_INSTALLED

$ErrorActionPreference = 'SilentlyContinue'
$VULN_COMMIT = 'ff226f6d8013dee2de5a6553abaf67bf32b3e875'
# Set this to the upstream-tagged fixed version once published.
$FIXED_VERSION = '1.4.1'  # placeholder — update when RustDesk tags the capability-clear release

$paths = @(
    "$env:ProgramFiles\RustDesk\rustdesk.exe",
    "${env:ProgramFiles(x86)}\RustDesk\rustdesk.exe",
    "$env:LOCALAPPDATA\RustDesk\rustdesk.exe"
)

$exe = $paths | Where-Object { Test-Path $_ } | Select-Object -First 1
if (-not $exe) {
    Write-Output 'UNKNOWN: RustDesk not installed in standard locations'
    exit 2
}

try {
    $info = (Get-Item $exe).VersionInfo
    $ver  = $info.ProductVersion
    if (-not $ver) { $ver = $info.FileVersion }
} catch {
    Write-Output "UNKNOWN: could not read version from $exe"
    exit 2
}

Write-Output "Detected RustDesk $ver at $exe"

# Compare semantic version: if lower than FIXED_VERSION -> vulnerable.
function Test-VersionLess($a, $b) {
    try { return ([version]$a) -lt ([version]$b) } catch { return $true }
}

if (Test-VersionLess $ver $FIXED_VERSION) {
    Write-Output "VULNERABLE: $ver < $FIXED_VERSION (CVE-2026-58056 / commit $VULN_COMMIT)"
    exit 1
} else {
    Write-Output "PATCHED: $ver >= $FIXED_VERSION"
    exit 0
}