CVE-2026-65976

Summary

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.

Affected Software

VendorProductVersion RangeStatus
deskflowdeskflow>= 1.17.0, < 1.26.0.300affected

Weaknesses

  • CWE-400: CWE-400: Uncontrolled Resource Consumption

References