CVE-2026-65976
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble(), causing the server or client to append data beyond the declared DataStart size and configured clipboard limit, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
Risk Assessment
An attacker can remotely exhaust the memory of the Deskflow process, potentially leading to denial of service or application crash.
Recommendation
Update Deskflow to version 1.26.0.300 or later to mitigate the vulnerability.
Other vulnerabilities in Deskflow
See all- CVE-2026-44296High
Deskflow, a keyboard and mouse sharing app, has a remote denial of service (DoS) vulnerability prior to version 1.26.0.167. Attackers can disrupt input delivery to all connected screens by sending malformed TCP connections.
- CVE-2026-65832High
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
- CVE-2026-63409High
Deskflow from version 1.17.0 until continuous build 1.26.0.296 has a vulnerability where a malicious Deskflow server can send an odd-length DSOP vector, causing an out-of-bounds read and crashing the connected client.
Original NVD description (English source)
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS