CVE-2026-76840: RustDesk Windows Clipboard Redirection Heap Overflow (CVSS 9.6) — Detection, Hunting, and Remediation Guide

---
title: RustDesk Session Followed by Suspicious Child Process Execution
id: 3f8a1c92-7b4d-4e6a-9f21-5c8d2e1a6b70
status: experimental
description: Detects rustdesk.exe spawning command interpreters, scripting engines, or LOLBins, which may indicate post-exploitation activity following clipboard redirection abuse such as CVE-2026-76840.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76840
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\rustdesk.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrator-initiated remote support sessions where the technician opens a shell on the endpoint
level: high
---
title: Application Crash of RustDesk or Explorer During Remote Session
id: 9c2d4e61-3a7f-4b58-8d10-6e9f1a2c5b84
status: experimental
description: Detects Windows Error Reporting (WerFault) invocation for rustdesk.exe or explorer.exe, a potential indicator of heap corruption from a malformed CLIPRDR FileContentsResponse (CVE-2026-76840).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76840
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\WerFault.exe'
    CommandLine|contains:
      - 'rustdesk.exe'
      - 'explorer.exe'
  condition: selection
falsepositives:
  - Ordinary application instability; correlate with active RustDesk session telemetry before escalation
level: medium
---
title: RustDesk Client Connection to Non-Corporate Relay or ID Server
id: 5e7b3a14-2c9d-4f68-a135-8b4e6d0c9a27
status: experimental
description: Detects rustdesk.exe establishing outbound connections on default RustDesk service ports (TCP 21115-21119, UDP 21116), which may indicate use of an unauthorized or attacker-controlled relay in CVE-2026-76840 exploitation scenarios.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76840
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith: '\rustdesk.exe'
  selection_port:
    DestinationPort:
      - 21115
      - 21116
      - 21117
      - 21118
      - 21119
  filter_approved:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection_image and selection_port and not filter_approved
falsepositives:
  - Connections to the official public RustDesk relay infrastructure; tune filter_approved to your sanctioned relay/IP ranges
level: medium

// Hunt: RustDesk clipboard-overflow exposure — unauthorized installs, suspicious sessions, and crash artifacts
// 1) Endpoints running RustDesk (inventory for CVE-2026-76840 exposure assessment)
DeviceProcessEvents
| where FileName =~ "rustdesk.exe" or ProcessCommandLine has "rustdesk"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ExecutionCount=count()
  by DeviceName, FolderPath, SHA256
| order by LastSeen desc;

// 2) RustDesk connections to non-allowlisted relays (adjust allowlist to your sanctioned ID/relay servers)
let ApprovedRelays = dynamic(["relay.yourcompany.example.com", "203.0.113.10"]);
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "rustdesk.exe"
| where RemotePort in (21115, 21116, 21117, 21118, 21119)
| where not(RemoteUrl in (ApprovedRelays) or RemoteIP in (ApprovedRelays))
| summarize Connections=count(), Ports=make_set(RemotePort), IPs=make_set(RemoteIP)
  by DeviceName, InitiatingProcessAccountName
| order by Connections desc;

// 3) Crash telemetry for rustdesk.exe / explorer.exe during or shortly after RustDesk activity (possible heap corruption)
let RustDeskDevices = DeviceProcessEvents
    | where FileName =~ "rustdesk.exe" and TimeGenerated > ago(7d)
    | summarize by DeviceName;
DeviceEvents
| where ActionType has "ExploitGuard" or FileName =~ "WerFault.exe"
| where DeviceName in (RustDeskDevices)
| project TimeGenerated, DeviceName, ActionType, FileName, ProcessCommandLine
| order by TimeGenerated desc;

// 4) Post-exploitation: LOLBin child processes spawned under rustdesk.exe
DeviceProcessEvents
| where InitiatingProcessFileName =~ "rustdesk.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe","cscript.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

-- CVE-2026-76840 exposure hunt: RustDesk installs, versions, and live relay connections
-- Deploy as a notebook/hunt across Windows endpoints to scope remediation priority.

SELECT
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE Name =~ '(?i)rustdesk'
   OR Exe =~ '(?i)rustdesk'

-- Correlate with live outbound connections on default RustDesk service ports
SELECT
    Pid,
    Name,
    Status,
    Laddr,
    Lport,
    Raddr,
    Rport
FROM netstat()
WHERE Name =~ '(?i)rustdesk'
   OR Rport in (21115, 21116, 21117, 21118, 21119)

-- Enumerate installed RustDesk binaries for version verification against the fixed release
SELECT
    FullPath,
    Size,
    Mtime
FROM glob(globs=[
    'C:/Program Files/RustDesk/**/*.exe',
    'C:/Users/*/AppData/**/rustdesk*.exe',
    'C:/Users/*/Downloads/rustdesk*.exe'
])

# CVE-2026-76840 - RustDesk clipboard redirection heap overflow
# Verify RustDesk presence/version, disable clipboard redirection as a workaround,
# and audit network exposure. Run elevated. Test in a pilot ring first.

$ErrorActionPreference = 'SilentlyContinue'
$report = [ordered]@{}

# --- 1. Locate RustDesk installations and capture version ---
$rustdeskPaths = @(
    "$env:ProgramFiles\RustDesk\rustdesk.exe",
    "${env:ProgramFiles(x86)}\RustDesk\rustdesk.exe"
)
$found = @()
foreach ($p in $rustdeskPaths) {
    if (Test-Path $p) { $found += $p }
}
# Catch per-user / portable installs
$found += Get-ChildItem -Path "$env:SystemDrive\Users" -Recurse -Filter 'rustdesk.exe' -ErrorAction SilentlyContinue |
          Select-Object -ExpandProperty FullName

$report.RustDeskFound = ($found.Count -gt 0)
$report.InstallPaths  = $found
$report.Versions      = $found | ForEach-Object { (Get-Item $_).VersionInfo.ProductVersion }

Write-Host "[i] RustDesk instances found: $($found.Count)"
$report.Versions | ForEach-Object { Write-Host "    Version: $_" }
Write-Host "[!] ACTION: Upgrade ALL instances to the latest RustDesk release that resolves CVE-2026-76840."
Write-Host "    Verify the fix at: https://nvd.nist.gov/vuln/detail/CVE-2026-76840 and the RustDesk GitHub security advisory."

# --- 2. WORKAROUND (pre-patch): disable clipboard redirection in RustDesk config ---
# RustDesk reads per-user config from %APPDATA%\RustDesk\config\RustDesk2.toml
$users = Get-ChildItem "$env:SystemDrive\Users" -Directory
foreach ($u in $users) {
    $cfg = Join-Path $u.FullName 'AppData\Roaming\RustDesk\config\RustDesk2.toml'
    if (Test-Path $cfg) {
        $content = Get-Content $cfg -Raw
        if ($content -match "enable-clipboard") {
            $content = $content -replace "enable-clipboard\s*=\s*'Y'", "enable-clipboard = 'N'"
            $content = $content -replace "enable-clipboard\s*=\s*'true'", "enable-clipboard = 'N'"
        } else {
            $content += "`n[options]`nenable-clipboard = 'N'`n"
        }
        Set-Content -Path $cfg -Value $content -Force
        Write-Host "[+] Clipboard redirection disabled in config: $cfg"
    }
}

# --- 3. Restrict RustDesk service ports at the host firewall until patched ---
$ruleName = 'Block-RustDesk-Relay-CVE-2026-76840'
if (-not (Get-NetFirewallRule -DisplayName $ruleName)) {
    New-NetFirewallRule -DisplayName $ruleName -Direction Outbound -Action Block `
        -RemotePort 21115,21116,21117,21118,21119 -Protocol TCP -Profile Any | Out-Null
    Write-Host '[+] Outbound block on RustDesk default service ports applied (remove after patching + approving relays).'
}

# --- 4. Audit: recent crash artifacts for rustdesk.exe / explorer.exe ---
$crashes = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000; StartTime=(Get-Date).AddDays(-7)} |
    Where-Object { $_.Message -match 'rustdesk\.exe|explorer\.exe' }
$report.RecentCrashEvents = @($crashes).Count
Write-Host "[i] Application Error events (rustdesk/explorer, last 7 days): $($report.RecentCrashEvents)"

$report | ConvertTo-Json -Depth 4