This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
Summary
AI summaryBroad release touches For more downloads, android, ipc, and linux.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Adds brute-force protection for one-time password. Adds brute-force protection for one-time password. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Security | High |
Hardens OS password anti-brute-force for terminal windows and headless Linux. Hardens OS password anti-brute-force for terminal windows and headless Linux. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Security | High |
Hardens local IPC authorization and portable‑service bootstrap flow. Hardens local IPC authorization and portable‑service bootstrap flow. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Feature | Medium |
Adds advanced CLI option to allow settings when custom client toggles Disable settings. Adds advanced CLI option to allow settings when custom client toggles Disable settings. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Feature | Medium |
Adds option to enable privacy mode and permanent change in accept window. Adds option to enable privacy mode and permanent change in accept window. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Feature | Medium |
Adds ability to drag the whole toolbar and snap it to all four edges of the remote session window. Adds ability to drag the whole toolbar and snap it to all four edges of the remote session window. Source: llm_adapter@2026-06-03 Confidence: low |
— |
| Feature | Medium |
Adds Android device deployment flow. Adds Android device deployment flow. Source: llm_adapter@2026-06-03 Confidence: low |
— |
| Feature | Medium |
Adds option to hide stop‑service UI when the service is running. Adds option to hide stop‑service UI when the service is running. Source: llm_adapter@2026-06-03 Confidence: low |
— |
| Feature | Low |
Allows dragging whole toolbar and snapping to window edges. Allows dragging whole toolbar and snapping to window edges. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Feature | Low |
Enables macOS monitor switching in privacy mode. Enables macOS monitor switching in privacy mode. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Feature | Low |
Implements callbacks to change theme and language. Implements callbacks to change theme and language. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes file‑transfer path traversal vulnerability. Fixes file‑transfer path traversal vulnerability. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Bugfix | Medium |
Fixes Android session closure on dispose to prevent reconnect wedges. Fixes Android session closure on dispose to prevent reconnect wedges. Source: llm_adapter@2026-06-03 Confidence: low |
— |
| Bugfix | Low |
Encrypts passwords securely. Encrypts passwords securely. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Disables mobile deeplink by default for security. Disables mobile deeplink by default for security. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Stops retrying on restricted mobile access errors. Stops retrying on restricted mobile access errors. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Adds Wayland clipboard input prompt handling. Adds Wayland clipboard input prompt handling. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Fixes IPC routing scope for active‑user requests. Fixes IPC routing scope for active‑user requests. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Corrects MSI uninstall behavior by checking install folder and removing files. Corrects MSI uninstall behavior by checking install folder and removing files. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Restores directory after file transfer reconnect. Restores directory after file transfer reconnect. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Removes unsafe exec() call in wf_cliprdr.c. Removes unsafe exec() call in wf_cliprdr.c. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Addresses Android image‑waiting issue causing stalls. Addresses Android image‑waiting issue causing stalls. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Improves terminal UTF‑8 handling on reconnect. Improves terminal UTF‑8 handling on reconnect. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Fixes Sciter control side behavior in privacy mode. Fixes Sciter control side behavior in privacy mode. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Resolves Safari OIDC authentication issue. Resolves Safari OIDC authentication issue. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Enables mouse side buttons in remote Linux sessions. Enables mouse side buttons in remote Linux sessions. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Debounces X11 keyboard grab and focus feedback on the client. Debounces X11 keyboard grab and focus feedback on the client. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Improves Flutter address book error handling. Improves Flutter address book error handling. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Adjusts Flutter IME capitalization after one‑shot input. Adjusts Flutter IME capitalization after one‑shot input. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Corrects Windows executable icon path. Corrects Windows executable icon path. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
| Bugfix | Low |
Fixes Sciter clipboard handling on COSMIC/DMA‑BUF portals for screencast. Fixes Sciter clipboard handling on COSMIC/DMA‑BUF portals for screencast. Source: granite4.1:30b@2026-06-03-audit Confidence: low |
— |
Full changelog
| Architecture | Windows | Ubuntu | Mac | Android | Flatpak | iOS | Web |
|--------------|---------|--------|-----|----------|---------|---------|---------|
| x86-64 (64-bit) | EXE MSI | Download | Download | Universal | Download | | Go |
| AArch64 (ARM64) | | Download | Download | Download | Download | App Store | |
| ARMv7 (32-bit) | | Download | | Download | | |
| x86-32 (32-bit) | EXE (Legacy)| | | | | |
For more downloads (Fedora / Arch Linux / Suse / AppImage): check below please
For the latest features: check out the nightly build
Changelog
ChangelogAdded
- Add advanced option to allow CLI settings when custom client toggles Disable settings #15138
- Add Android device deployment flow #15146
- Drag whole toolbar; snap to all four edges of the remote session window #15051
- Github action hash pinned
- Allow macOS monitor switching in privacy mode #15004
- feat: option, enable-privacy-mode & enable-perm-change-in-accept-window #14875
- impl(cm): implement change_theme and change_language callbacks #14782
- add brute-force protection for one-time password #14682
- add option to hide stop-service when service is running #14563
- --deploy, reuse the device token #15035
Changes
- refact(password): encrypt #15073
- Harden os password （terminal windows and headless linux) anti brute force #14985
- mobile: deeplink, disable by default #14824
- stop retrying on restricted mobile access errors #14797
- (keyboard): wayland clipboard input prompt #14700
Fixes
- fix: bytes codec, reserver(), check max #15168
- fix(crypt): symmetric crypt, zero nonce #15144
- fix: add integer overflow check in wf_cliprdr.c #15142
- fix(android): close session on dispose to prevent reconnect wedge #15143
- scrap/wayland: insert videoconvert to fix screencast on COSMIC / DMA-BUF portals #15063
- fix(ipc): scope active-user IPC routing to root CLI main requests #15058
- fix(msi): check install folder, remove files when uninstall #15011
- fix(custom-client): desktop, incoming only, touch drag #14928
- fix(fs): file transfer, reconnect, restore dir #14925
- fix: remove unsafe exec() in wf_cliprdr.c #14924
- fix(android): waiting for image, one cause #14919
- Terminal utf8 and reconnect #14895
- fix(sicter): control side, privacy mode #14880
- fix safari-oidc https://github.com/rustdesk/rustdesk/issues/14861 #14867
- fix(linux): enable mouse side buttons in remote sessions #14848
- fix(client): serialize X11 keyboard grab and debounce focus feedback #14836
- flutter: improve address book pull error handling #14813
- flutter: shift after one shot IME capitalization #14695
- fix(win): exe icon path #14686
- fix: file transfer, path traversal #14678
- fix(ipc): harden local IPC authorization and portable-service bootstrap flow #14671
- fix switch sides for macOS peers #14661
- fix(iOS): preserve local pasteboard sync from Windows hosts #14659
- fix(iPad): keep touch gestures with external mouse #14652
- Fix Windows session-based logon and lock-screen detection #14620
- fix(shell): restrict kv in update_install_option #14564
- fix(linux): prevent X11 BadWindow crash in get_focused_display #14561
- Fix(wayland): improve error message when xdg-desktop-portal is unavailable #12897 #14543
- Fix Linux tray icon collision with other tray-icon crate apps #14530
- Fix: note dialog not shown when closing session from reconnecting screen #14528
- fix: iPad mouse down detection for physical mouse input #14515
- fix(mobile): restore canvas offset after hidding the soft keyboard #14506
- fix empty strategy value cannot apply over default advanced options #14502
- fix(flutter): reduce accidental horizontal trackpad scrolling during vertical pan #14460
- Move port mapping afterwards #14448
- fix(update): macos, test before update #14446
Security Fixes
- Add brute-force protection for one-time password (#14682)
- Harden OS password anti‑brute force on terminal windows and headless Linux (#14985)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About rustdesk/rustdesk
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]