CVE-2026-2490

RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/rustdesk/rustdesk/pull/13736
https://www.zerodayinitiative.com/advisories/ZDI-26-117/

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) RustDesk Cliente para Windows: Vulnerabilidad de revelación de información en el enlace de transferencia de archivos. Esta vulnerabilidad permite a atacantes locales revelar información sensible en instalaciones afectadas de RustDesk Cliente para Windows. Un atacante debe primero obtener la capacidad de ejecutar código con pocos privilegios en el sistema objetivo para explotar esta vulnerabilidad. La falla se encuentra en la característica de Transferencia de Archivos. Al cargar un enlace simbólico, un atacante puede abusar del servicio para leer archivos arbitrarios. Un atacante puede aprovechar esta vulnerabilidad para revelar información en el contexto de SYSTEM. Fue ZDI-CAN-27909.

20 Feb 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-20 23:16

Updated : 2026-06-17 10:31

NVD link : CVE-2026-2490

Mitre link : CVE-2026-2490

CVE.ORG link : CVE-2026-2490

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-2490", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2490", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T15:14:47.878083Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "RustDesk", "product": "Client for Windows", "versions": [{"status": "affected", "version": "1.4.1"}], "defaultStatus": "unknown"}]}], "published": "2026-02-20T23:16:05.300", "references": [{"url": "https://github.com/rustdesk/rustdesk/pull/13736", "source": "zdi-disclosures@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-117/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909."}, {"lang": "es", "value": "RustDesk Cliente para Windows: Vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en el enlace de transferencia de archivos. Esta vulnerabilidad permite a atacantes locales revelar informaci\u00f3n sensible en instalaciones afectadas de RustDesk Cliente para Windows. Un atacante debe primero obtener la capacidad de ejecutar c\u00f3digo con pocos privilegios en el sistema objetivo para explotar esta vulnerabilidad.\n\nLa falla se encuentra en la caracter\u00edstica de Transferencia de Archivos. Al cargar un enlace simb\u00f3lico, un atacante puede abusar del servicio para leer archivos arbitrarios. Un atacante puede aprovechar esta vulnerabilidad para revelar informaci\u00f3n en el contexto de SYSTEM. Fue ZDI-CAN-27909."}], "lastModified": "2026-06-17T10:31:09.523", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}