# Risk map — rustdesk/rustdesk

> Canonical page: https://codevetter.com/unpack/rustdesk/risk-map

# Risk map — rustdesk/rustdesk

Scanned commit c6a358afbe37c518689a6157a8e8cdbd645dcc5d (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The riskiest surface is the unauthenticated pre-login path (deliberately bounded by slot pools and message caps), the IPC bridge between privileged service and user processes (heavily hardened with uid/executable checks), and updater/portable paths that write executables and delete files. Heavy use of forked/patched crypto-adjacent deps (webrtc, tungstenite, kcp) and `panic=abort` release profile amplify small defects. The empty hbb_common submodule means the actual wire crypto/proto code cannot be audited in this clone.
- Unauthenticated-connection resource guards: MAX_UNAUTHORIZED_CONNS=64 global, 16 per address, LOGIN_GRACE=180s, MAX_UNAUTHORIZED_MESSAGE=128KiB, plus PunchPool caps (32 UDP + 32 TCP punches) and MAX_WEBRTC_ANSWERERS=16 — all tuned against pre-auth DoS; weakening any of these constants is a security regression. — [src/server/connection.rs#L83-141](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/server/connection.rs#L83-L141) [src/rendezvous_mediator.rs#L62-119](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/rendezvous_mediator.rs#L62-L119)
- MITM hardening on WebRTC: the controlled side signs its DTLS fingerprint into IdPk and the controller fails closed on mismatch ('possible MITM' bails); removing the dtls_fingerprint_bound check would silently downgrade to an unauthenticated channel. — [src/server.rs#L270-278](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/server.rs#L270-L278) [src/client.rs#L1699-1731](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/client.rs#L1699-L1731)
- IPC authentication is platform-specific and intricate: ipc/auth.rs has Windows executable-identity checks (ensure_peer_executable_matches_current_by_pid_opt, portable-service token handshake), Linux uid allow-listing (is_allowed_service_peer_uid, peer_uid_from_fd) and SCM_RIGHTS fd passing for DRM capture (ipc/drm.rs) — a privileged-root attack surface. — [src/ipc.rs#L49-78](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/ipc.rs#L49-L78) [src/ipc/auth.rs](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/ipc/auth.rs) [src/ipc/drm.rs](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/ipc/drm.rs)
- Path-traversal-hardened file deletion: portable packer's resolve_within rebuilds meta.toml-listed paths component-by-component rejecting prefixes/roots/parents/colons because meta.toml sits in a user-writable dir and drives deletion — prior-traversal-bug-shaped code. — [libs/portable/src/main.rs#L87-116](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/libs/portable/src/main.rs#L87-L116)
- Updater runs with root/service privileges: macOS update requires a root-owned /var/run/rustdesk-update.lock with O_NOFOLLOW + flock; Windows update_me/--update path and `platform::install_me` copy executables — a compromised api-server/URL could push code (update URLs come from config/options). (inferred) — [src/updater.rs#L27-58](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/updater.rs#L27-L58) [src/core_main.rs#L229-255](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/core_main.rs#L229-L255)
- Shell-out surface: core_main/platform code spawns pkill, caffeinate, cmdkey/mstsc (rdp), gtk_sudo::exec, terminal_helper ConPTY processes, and install/uninstall scripts; args are mostly fixed strings but `run_rdp` reads rdp_username/rdp_password env vars into cmdkey args. — [src/core_main.rs#L402-407](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/core_main.rs#L402-L407) [src/server.rs#L236-247](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/server.rs#L236-L247) [src/port_forward.rs#L19-30](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/port_forward.rs#L19-L30)
- panic='abort' in release profile + pervasive `.unwrap()` on locks (e.g. `server.write().unwrap()`, `conns.lock().unwrap()`) means any poisoning or panic aborts the whole process including active sessions; AGENTS.md bans unwrap but legacy code is full of it. (inferred) — [Cargo.toml#L282-286](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/Cargo.toml#L282-L286) [src/server.rs#L221](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/server.rs#L221) [AGENTS.md](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/AGENTS.md)
- The strategy-sync path lets the self-hosted server push arbitrary Config options (`StrategyOptions.config_options` applied to Config) — a malicious/compromised api-server could flip security options like enable-lan-discovery or disable-clipboard on all clients. (inferred) — [src/hbbs_http/sync.rs#L45-51](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/hbbs_http/sync.rs#L45-L51) [src/hbbs_http/sync.rs#L85-130](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/hbbs_http/sync.rs#L85-L130)
- 2FA secret handling: TOTP secret is generated per generate2fa() and stored via encrypt_vec_or_original with a hardcoded "00" key context in config — obfuscation-grade encryption at rest, not real protection. — [src/auth_2fa.rs#L54-73](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/auth_2fa.rs#L54-L73) [src/auth_2fa.rs#L76-100](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/auth_2fa.rs#L76-L100)
- Legacy Sciter UI (src/ui/) still compiled when `flutter` feature is off and reachable via ui::start — deprecated but alive code paths (CUR_SESSION, SciterHandler) enlarge the maintenance/audit surface. — [src/ui.rs#L32-60](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/ui.rs#L32-L60) [src/main.rs#L29-31](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/src/main.rs#L29-L31)
- Forked network stack risk: webrtc/webrtc-sctp/webrtc-util and tungstenite are pinned to rustdesk-org forks with custom congestion-control and parsing changes; upstream CVE fixes will not flow through cargo update and must be cherry-picked by rev. (inferred) — [Cargo.toml#L219-253](https://github.com/rustdesk/rustdesk/blob/c6a358afbe37c518689a6157a8e8cdbd645dcc5d/Cargo.toml#L219-L253)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)