Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-28 | 1 | Disclosure1 |
| 2026-06-29 | 1 | General1 |
CVE-2026-58056 Privilege Escalation in RustDesk via Uncleared FileTransfer Session Capability Flags https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58056
Post summary
RustDesk has a privilege‑escalation vulnerability (CVE‑2026‑58056) caused by improperly handled file‑transfer session capability flags.
CVE-2026-58056 RustDesk Incorrect authorisation could let attackers access beyond the authorised session, turning remote access tooling into a wider endpoint-control risk Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-28/TIER_2_CVE-2026-58056.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
An authorization flaw in RustDesk (CVE‑2026‑58056) could allow attackers to expand session privileges; the report provides technical details but no PoC, exploit code, patch, or evidence of active exploitation.