CVE-2026-65832 in Deskflow
Summary
by MITRE • 08/17/2026
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2026
Deskflow serves as a utility for sharing keyboard and mouse input across multiple computers, allowing users to control one machine from another via a client-server architecture. The vulnerability described involves the server component's handling of specific message types sent by unauthenticated clients during the initial phases of connection or configuration exchange. Specifically, the flaw resides in how the ServerProxy class processes DSOP values associated with modifier options within its setOptions method. When an attacker sends crafted kMsgDSetOption messages containing a malformed number of modifiers or specifically structured option data, it triggers logic errors that compromise memory safety and application stability.
The core technical issue stems from improper validation of input parameters before they are used to index into internal translation tables. The m_modifierTranslationTable is poisoned by the attacker-controlled value following a modifier option. Subsequently, when functions such as translateKey or translateModifierMask attempt to process these inputs, they access s_translationTable and s_masks arrays using indices derived from this corrupted state. Because there is no adequate bounds checking on these array accesses relative to their defined sizes, the application performs out-of-bounds reads. This allows an attacker to read four bytes of memory located at a relative offset determined by the crafted input. Such behavior constitutes a classic buffer over-read vulnerability, which can lead to information disclosure if sensitive data resides in adjacent memory locations or cause denial of service through segmentation faults and crashes when invalid pointers are dereferenced.
Additionally, the logic error extends to an odd option count scenario within the OptionsList processing routine. This condition also results in out-of-bounds reads, further expanding the attack surface for potential information leakage or application instability. The lack of rigorous input sanitization means that any connected client, without needing prior authentication, can exploit these flaws by sending specially constructed network packets containing malformed modifier options and option lists.
From a classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read, as it involves reading beyond the allocated buffer boundaries. It also relates to CWE-20 Improper Input Validation due to the failure to verify that input parameters conform to expected ranges before use in array indexing operations. In terms of attack vectors and tactics, this falls under ATT&CK technique T1567 Exfiltration Over Alternative Protocol if the out-of-bounds read is leveraged for data exfiltration, or more broadly as part of initial access exploitation where stability issues might be used to disrupt service availability in a denial of service context.
The operational impact includes both confidentiality and integrity risks alongside availability concerns. Successful exploitation can result in the disclosure of internal application memory contents, which may contain sensitive information such as authentication tokens, configuration data, or other process-specific secrets depending on what resides in adjacent memory spaces relative to the target arrays. Furthermore, triggering a crash denies service to legitimate users relying on Deskflow for their workflow continuity. The fact that this occurs prior to continuous build 1.26.0.299 indicates that earlier versions are susceptible until patched.
Mitigation strategies primarily involve upgrading to fixed builds where input validation has been strengthened and bounds checking implemented correctly within the ServerProxy logic. Organizations should ensure all Deskflow instances are updated to version 1.26.0.299 or later immediately upon availability. In environments where immediate patching is not feasible, network segmentation can limit exposure by restricting access to the Deskflow server ports only from trusted client IP addresses. Additionally, deploying intrusion detection systems capable of identifying anomalous packet structures or unusual memory access patterns may provide an additional layer of defense against exploitation attempts targeting this specific flaw.