RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connections to cause memory exhaustion and denial of service. The fix caps header-triggered speculative preallocation at 256 KiB.

RustDesk versions prior to 1.4.7 are affected by an uncontrolled speculative memory allocation vulnerability in the BytesCodec component. The decoder blindly trusts the payload length value encoded in a four-byte frame header before authentication is completed, reserving memory up to approximately 1 GB per crafted request. Unauthenticated attackers can exploit this by opening multiple concurrent TCP connections with malicious headers, causing memory exhaustion and denial of service on the target system. The vulnerability requires no authentication, significantly lowering the bar for exploitation. The fix introduced in version 1.4.7 caps speculative preallocation triggered by headers at 256 KiB, preventing runaway memory consumption. Patches are available via commits to both the rustdesk and hbb_common repositories on GitHub.