CVE-2026-65976: falha de média gravidade em deskflow
Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.5%
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Produtos afetados
deskflow · deskflowCVEs relacionadas — deskflow
No mesmo produto, das mais perigosas para as menos.
CVE-2026-65832HIGHDeskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexingEPSS 0.6%CVE-2026-63409HIGHDeskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow clientEPSS 0.5%CVE-2026-41476HIGHDeskflow: clipboard deserialization global-buffer-overflowEPSS 0.3%CVE-2026-44296HIGHDeskflow: TLS multiplexer DoS on failed `SSL_accept`EPSS 0.3%CVE-2026-41477HIGHDeskflow: Local privilege escalation via unauthenticated IPCEPSS 0.2%