RustDesk
RustDesk
Open-source remote desktop and remote support platform.
1.4.9
- Release date
- July 06, 2026
- Security status
- Current version appears affected by 2 high-severity CVEs.
Source
GitHub API
Public release notes are linked for the latest stored release.
Release history
See the latest published releases stored for this product.
| Version | Published | Notes |
|---|---|---|
| 1.4.9 | 2026-07-06 | Release Notes |
| 1.4.8 | 2026-06-21 | Release Notes |
| 1.4.7 | 2026-06-02 | Release Notes |
| 1.4.6 | 2026-03-05 | Release Notes |
Vulnerability tracking
versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.
Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.
| CVE | Severity | Published | Status | Summary |
|---|---|---|---|---|
| CVE-2026-57850 | HIGH (8.7) | 2026-07-10 | Current versionaffected | RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope control messages to observe and control the host beyond the permissions it was given. Affected versions
|
| CVE-2026-58056 | HIGH (7.6) | 2026-06-28 | Current versionaffected | RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope. Affected versions
|