Description

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connections to cause memory exhaustion and denial of service. The fix caps header-triggered speculative preallocation at 256 KiB.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T14:17:12.830Z",
  "pubdate": "2026-08-26T14:17:12.830Z",
  "executiveSummary": "RustDesk versions prior to 1.4.7 are susceptible to an uncontrolled speculative memory allocation vulnerability located within the BytesCodec component. This flaw constitutes a significant security risk, enabling unauthenticated remote attackers to trigger a denial-of-service (DoS) condition via memory exhaustion.\nThe vulnerability arises from improper input validation of a four-byte frame header during the initial stages of a TCP connection, specifically before the authentication phase. By supplying a crafted payload length value, an attacker can force the application to perform large-scale speculative memory allocations.\nBy initiating multiple concurrent TCP connections and providing malicious headers, an attacker can deplete the host system's available memory, leading to service instability or application crashes. This vulnerability is particularly critical due to the lack of required authentication or elevated privileges, allowing any entity with network access to the RustDesk service to conduct this attack. The risk implication is a high availability impact, necessitating an immediate upgrade to version 1.4.7 or later to implement the required memory allocation constraints.",
  "technicalDetails": "The vulnerability resides in the BytesCodec component of the RustDesk communication stack. The root cause is the trust placed in a four-byte frame header provided by the client during the early stages of the protocol handshake, specifically prior to the completion of authentication. When the decoder processes this header, it extracts a length field that dictates the size of a buffer to be preallocated for the incoming payload.\nThe application architecture fails to perform sufficient boundary checks or sanitization on this length value before invoking memory allocation routines. Consequently, an attacker can provide a length value as large as 1,073,741,823 bytes. The decoder blindly honors this value, allocating speculative capacity in anticipation of the full payload. Because these allocations occur before the payload is actually received or verified, the service is vulnerable to resource exhaustion.\nThe exploitation flow is as follows: 1. The attacker initiates a TCP connection to the RustDesk service. 2. The attacker transmits a crafted four-byte frame header containing an artificially high payload length value. 3. The BytesCodec component reads the header and reserves a corresponding chunk of memory. 4. By establishing multiple concurrent TCP connections, each sending such headers, the attacker causes a rapid accumulation of allocated memory. 5. This sustained memory pressure exceeds the available system RAM or memory limits, causing the process to terminate due to an out-of-memory condition or significantly degrading the performance of the host system, effectively resulting in a denial-of-service.\nThis vulnerability is classified as an uncontrolled speculative memory allocation issue. Because it requires no authentication and no specific privileges, the attack surface is limited only by network reachability to the RustDesk service. The remediation implemented in version 1.4.7 addresses this by introducing a strict cap on header-triggered speculative preallocation, limiting it to a maximum of 256 KiB, thereby preventing an attacker from requesting excessive memory reserves through header manipulation."
}