CVE-2026-65976
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble(), causing the server or client to append data beyond the declared DataStart size and configured clipboard limit, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
Risk Assessment
An attacker can remotely exhaust the memory of the Deskflow process, potentially leading to denial of service or application crash.
Recommendation
Update Deskflow to version 1.26.0.300 or later to mitigate the vulnerability.
Original NVD description (English source)
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.