CVE-2026-65832
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
Risk Assessment
The risk includes memory disclosure from the client or client crash, which could lead to confidentiality breaches and service disruption.
Recommendation
It is recommended to immediately upgrade Deskflow to continuous build 1.26.0.299 or later, which contains the fix.
Other vulnerabilities in Deskflow
See all- CVE-2026-44296High
Deskflow, a keyboard and mouse sharing app, has a remote denial of service (DoS) vulnerability prior to version 1.26.0.167. Attackers can disrupt input delivery to all connected screens by sending malformed TCP connections.
- CVE-2026-65976Medium
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble(), causing the server or client to append data beyond the declared DataStart size and configured clipboard limit, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
- CVE-2026-63409High
Deskflow from version 1.17.0 until continuous build 1.26.0.296 has a vulnerability where a malicious Deskflow server can send an odd-length DSOP vector, causing an out-of-bounds read and crashing the connected client.
Original NVD description (English source)
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS