CVE-2026-63409 in Deskflow
Summary
by MITRE • 08/17/2026
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
Deskflow, a utility designed for sharing keyboards and mice across multiple computers via a networked server-client architecture, contains a critical input validation flaw within its core communication protocol implementation. The vulnerability exists in the ServerProxy component, specifically affecting versions from 1.17.0 up to continuous build 1.26.0.295. This software relies on a custom binary protocol known as DSOP for handling configuration and handshake messages between the server and connected clients. During the initial connection phase or when updating options, the client expects well-formed data structures that adhere to specific length constraints defined by the protocol specification.
The technical root cause of this vulnerability lies in the ServerProxy::setOptions function located in src/lib/client/ServerProxy.cpp. When a malicious Deskflow server initiates communication with a vulnerable client, it can transmit an odd-length DSOP vector as part of its handshake or configuration payload. The application logic fails to validate whether the length of the received option data is even before attempting to parse key-value pairs from this stream. This lack of boundary checking allows the parsing routine to proceed under the assumption that every byte has a corresponding partner, leading to an out-of-bounds read condition.
The exploitation chain begins when the malicious server sends the malformed odd-length vector through the network socket. The data is received by PacketStreamFilter::filterEvent and passed down to ServerProxy::handleData(). From there, it enters ServerProxy::parseHandshakeMessage(), which attempts to deserialize the incoming bytes into structured option objects. Because the final key in the DSOP vector lacks a corresponding value due to the odd length, the parser reads memory beyond the allocated buffer boundaries while trying to retrieve this missing value. This out-of-bounds read results in an immediate application crash on the client side, effectively causing a denial of service against any user running a vulnerable version of Deskflow who connects to a compromised or malicious server instance.
From a security classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end, or before the beginning, of the intended buffer. It also relates to CWE-20, Improper Input Validation, as the application fails to verify that the input length conforms to expected parity constraints for key-value pair structures. In terms of attack vectors, this represents a server-side initiated exploit where an attacker controls the network endpoint rather than injecting code through user interaction with local files or web forms. This maps closely to MITRE ATT&CK techniques involving initial access via compromised infrastructure or supply chain compromise if the malicious server is disguised as a legitimate Deskflow instance within a corporate environment.
The operational impact of this flaw is primarily limited to availability, as it results in a crash rather than arbitrary code execution or information disclosure through memory leakage. However, because Deskflow often runs with elevated privileges to manage input devices across systems, a denial-of-service attack could disrupt workflow continuity and potentially be used as part of a larger campaign to distract security teams while other malicious activities occur on the networked endpoints. Users who rely on seamless keyboard sharing for productivity are directly affected if they connect to untrusted or compromised servers.
Mitigation strategies focus heavily on version management and network segmentation. The most effective remediation is to upgrade Deskflow immediately to continuous build 1.26.0.296 or any later release where the input validation logic has been corrected to ensure that DSOP vectors are properly validated for even length before parsing begins. Until an update can be applied, organizations should restrict access to Deskflow servers by implementing strict firewall rules and only allowing connections from known, trusted IP addresses. Additionally, deploying network intrusion detection systems capable of identifying anomalous binary protocol traffic may help in detecting attempts to exploit this specific out-of-bounds read condition before it causes a client crash.