CVE-2026-58056

9th percentile — higher than 9% of all known CVEs

A vulnerability in RustDesk allows privilege escalation within a file transfer session. The gating of incoming control messages is based on per-capability flags rather than the session's authorized connection type, and a file transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

The risk is that an attacker with limited access (file transfer only) can take over the victim's desktop, steal sensitive on-screen data, or perform unauthorized actions, compromising system integrity and confidentiality.

Immediately update RustDesk to a version that fixes this vulnerability and enforce clearing of capability flags on every session type change. Until the update, limit trust in file transfer connections.