CVE-2026-65832highCWE-125CWE-129

CVE-2026-65832: high-severity vulnerability in deskflow

Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing

Published · Updated

Follow this CVE+ Monitor deskflow+ Monitor deskflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.6%
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected products
deskflow · deskflow
Related CVEs — deskflow

In the same product, most dangerous first.

CVE-2026-65976MEDIUMDeskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limitEPSS 0.5%CVE-2026-63409HIGHDeskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow clientEPSS 0.5%CVE-2026-41476HIGHDeskflow: clipboard deserialization global-buffer-overflowEPSS 0.3%CVE-2026-44296HIGHDeskflow: TLS multiplexer DoS on failed `SSL_accept`EPSS 0.3%CVE-2026-41477HIGHDeskflow: Local privilege escalation via unauthenticated IPCEPSS 0.2%