Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-65976 EUVD-2026-60466

Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit

Published Aug 17, 2026 · Updated Aug 18, 2026 · Assigned by GitHub_M

Description

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.

Affected products

VendorProductAffectedFixed
deskflow deskflow >= 1.17.0, < 1.26.0.300 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 deskflow 1.26.0+dfsg-4 —
Debian 13 deskflow No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 deskflow No fix yet —
Ubuntu 26.04 LTS deskflow No fix yet —

References