CVE-2026-73108: RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connections to cause memory exhaustion and denial of service. The fix caps header-triggered speculative preallocation at 256 KiB.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustDeskto a version that resolves this vulnerability.Fixed in 1.4.7 - Configuration
Ensure the BytesCodec fix is applied so the four-byte frame header–triggered speculative preallocation is capped at 256 KiB (to prevent requesting up to 1,073,741,823 bytes).
RustDesk BytesCodec header-triggered speculative preallocation cap = 256 KiB
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker able to establish TCP connections to an affected RustDesk instance can exploit it. Authentication is not required because the vulnerable frame decoding occurs before authentication.
What does an attacker need to send?
The attacker needs to send crafted four-byte frame headers that declare very large payload lengths. The decoder may reserve up to 1,073,741,823 bytes based on the header before the payload is received, and concurrent connections can exhaust available memory.
Are patched versions protected by a size limit?
Yes. RustDesk 1.4.7 caps speculative memory preallocation triggered by a frame header at 256 KiB.
How can I determine whether an instance is affected?
RustDesk versions earlier than 1.4.7 are affected. Instances exposed to TCP connections are susceptible to unauthenticated memory-exhaustion attempts.