CVE-2026-2490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2490", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-02-13T21:13:34.414Z", "datePublished": "2026-02-20T22:24:43.064Z", "dateUpdated": "2026-02-24T15:16:07.584Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-02-20T22:24:43.064Z"}, "title": "RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability", "descriptions": [{"lang": "en", "value": "RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909."}], "affected": [{"vendor": "RustDesk", "product": "Client for Windows", "versions": [{"version": "1.4.1", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-117/", "name": "ZDI-26-117", "tags": ["x_research-advisory"]}, {"url": "https://github.com/rustdesk/rustdesk/pull/13736", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-02-13T21:13:34.461Z", "datePublic": "2026-02-19T14:20:43.256Z", "source": {"lang": "en", "value": "mad31k"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T15:14:47.878083Z", "id": "CVE-2026-2490", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:16:07.584Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2490", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T15:14:47.878083Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:16:02.686Z"}}], "cna": {"title": "RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability", "source": {"lang": "en", "value": "mad31k"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "RustDesk", "product": "Client for Windows", "versions": [{"status": "affected", "version": "1.4.1"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-19T14:20:43.256Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-117/", "name": "ZDI-26-117", "tags": ["x_research-advisory"]}, {"url": "https://github.com/rustdesk/rustdesk/pull/13736", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-02-13T21:13:34.461Z", "descriptions": [{"lang": "en", "value": "RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-02-20T22:24:43.064Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2490", "state": "PUBLISHED", "dateUpdated": "2026-02-24T15:16:07.584Z", "dateReserved": "2026-02-13T21:13:34.414Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-02-20T22:24:43.064Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Client for Windows", "vendor": "RustDesk", "versions": [{"status": "affected", "version": "1.4.1"}]}], "source": "zdi-disclosures@trendmicro.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909."}, {"lang": "es", "value": "RustDesk Cliente para Windows: Vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en el enlace de transferencia de archivos. Esta vulnerabilidad permite a atacantes locales revelar informaci\u00f3n sensible en instalaciones afectadas de RustDesk Cliente para Windows. Un atacante debe primero obtener la capacidad de ejecutar c\u00f3digo con pocos privilegios en el sistema objetivo para explotar esta vulnerabilidad.\n\nLa falla se encuentra en la caracter\u00edstica de Transferencia de Archivos. Al cargar un enlace simb\u00f3lico, un atacante puede abusar del servicio para leer archivos arbitrarios. Un atacante puede aprovechar esta vulnerabilidad para revelar informaci\u00f3n en el contexto de SYSTEM. Fue ZDI-CAN-27909."}], "id": "CVE-2026-2490", "lastModified": "2026-06-17T10:31:09.523", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2490", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T15:14:47.878083Z", "version": "2.0.3"}}]}, "published": "2026-02-20T23:16:05.300", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://github.com/rustdesk/rustdesk/pull/13736"}, {"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-117/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Client for Windows", "source": "cna", "vendor": "RustDesk"}, "product": "client_for_windows", "vendor": "rustdesk"}], "analysis": {"en": {"generated_at": "2026-04-18T11:23:14.973911+00:00", "value": {"mitigation_remediation": ["Review and install the latest RustDesk Client for Windows update once the vendor releases a fix for the Transfer File symbolic\u2011link handling flaw.", "If a patch is not yet available, disable the Transfer File feature or restrict its use to trusted users only to prevent symbolic\u2011link uploads.", "Enforce least privilege on the local machine and configure the operating system to prevent unauthorized execution of symbolic links, ensuring users cannot run code that could exploit the flaw."], "summary": {"action": "Apply Update", "impact": "Local attackers with low\u2011privileged code execution can upload a symbolic link through RustDesk Client for Windows Transfer File feature and read arbitrary files, potentially gaining SYSTEM\u2011level disclosure. The vulnerability is an Information Disclosure flaw."}, "threat_synthesis": {"affected_systems": "RustDesk Client for Windows is the affected product. The advisory does not list specific versions, indicating that all unpatched Windows client installations that allow symbolic\u2011link uploads are vulnerable.", "description_and_impact": "A local attacker who can run low\u2011privileged code on a Windows system may upload a symbolic link via the Transfer File feature in RustDesk Client. The client processes the link and reads the target file, allowing disclosure of arbitrary files on the host. If the attacker subsequently gains SYSTEM privileges, highly privileged data may be exposed. The weakness is an OS path traversal, classified as CWE\u201159.", "risk_and_exploitability": "The CVSS score of 5.5 indicates a medium risk level. EPSS is below 1\u202f%, implying a low probability of exploitation in the current landscape. The vulnerability is not included in the CISA KEV catalog. An attacker must first achieve local code execution, limiting the attack surface to individuals with direct access to the machine. Once privilege is gained, arbitrary file reading can occur, potentially compromising sensitive information. The overall risk is moderate but contingent on the presence of local privileged access."}}}}, "created": "2026-02-23T14:33:38.667457+00:00", "updated": "2026-04-18T11:30:44.317170+00:00", "vendors": ["rustdesk", "rustdesk$PRODUCT$client_for_windows"]}