CVE-2026-63409highCWE-125

CVE-2026-63409: falha de alta gravidade em deskflow

Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar deskflow+ Monitorar deskflow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.5%
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Produtos afetados
deskflow · deskflow
CVEs relacionadas — deskflow

No mesmo produto, das mais perigosas para as menos.

CVE-2026-65832HIGHDeskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexingEPSS 0.6%CVE-2026-65976MEDIUMDeskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limitEPSS 0.5%CVE-2026-41476HIGHDeskflow: clipboard deserialization global-buffer-overflowEPSS 0.3%CVE-2026-44296HIGHDeskflow: TLS multiplexer DoS on failed `SSL_accept`EPSS 0.3%CVE-2026-41477HIGHDeskflow: Local privilege escalation via unauthenticated IPCEPSS 0.2%