CVE-2026-65832: Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons mmodifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row stranslationTable or smasks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Deskflowto a version that resolves this vulnerability.Fixed in 1.26.0.299
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65832?
The severity of CVE-2026-65832 is rated high with a score of 8.2.
How do I fix CVE-2026-65832?
To fix CVE-2026-65832, update to continuous build 1.26.0.299 or later of Deskflow.
What type of vulnerability is CVE-2026-65832?
CVE-2026-65832 is classified as an out-of-bounds read vulnerability.
Who is affected by CVE-2026-65832?
CVE-2026-65832 affects users of Deskflow versions prior to continuous build 1.26.0.299.
What could an attacker do with CVE-2026-65832?
An attacker could exploit CVE-2026-65832 to perform remote unauthenticated access leading to potential data exposure.