CVE-2026-63409: Deskflow Buffer Overflow Vulnerability

CVE-2026-63409 Overview

CVE-2026-63409 is an out-of-bounds read vulnerability in Deskflow, an open-source keyboard and mouse sharing application. The flaw exists in versions from 1.17.0 up to continuous build 1.26.0.296. A malicious Deskflow server can send an odd-length DSOP (set options) vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp. Because the code assumes options arrive as key-value pairs, the missing value after the final option key is read beyond the vector bounds, crashing the connected client. The issue is tracked under CWE-125 and was fixed in continuous build 1.26.0.296.

Critical Impact
A malicious or compromised Deskflow server can remotely crash any connected client without authentication or user interaction, causing sustained denial of service across shared input sessions.

Affected Products

Deskflow versions 1.17.0 through builds prior to 1.26.0.296
Deskflow client component (src/lib/client/ServerProxy.cpp and src/lib/client/Client.cpp)
All platforms where Deskflow client is deployed (Windows, macOS, Linux)

Discovery Timeline

2026-08-17 - CVE-2026-63409 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-63409

Vulnerability Analysis

Deskflow's client-server protocol includes a DSOP (set options) message that transmits configuration key-value pairs. The client parses these options through the call chain PacketStreamFilter::filterEvent → ServerProxy::handleData() → ServerProxy::parseHandshakeMessage() → ServerProxy::setOptions().

The parser iterates the options vector two elements at a time, treating each pair as an option ID followed by its value. When a malicious server sends an odd-length vector, the loop reads past the final key into unallocated memory. This triggers an out-of-bounds read and crashes the client process.

Root Cause

The root cause is missing input validation on the size of the options vector before iteration. Neither ServerProxy::setOptions() nor Client::setOptions() verified that options.size() % 2 == 0 before treating consecutive elements as key-value pairs. Any attacker controlling the server side of the connection can violate this implicit invariant.

Attack Vector

Exploitation requires an attacker to operate or compromise a Deskflow server that a victim client connects to. This can be achieved through server impersonation on a shared network, a rogue server on an untrusted LAN, or a compromise of a legitimate server. Once connected, the attacker sends a crafted DSOP message with an odd-length payload during the handshake. No authentication or user interaction is required to trigger the crash.

cpp

// Security patch in src/lib/client/ServerProxy.cpp
// fix: Check options array is always an even size
  ProtocolUtil::readf(m_stream, kMsgDSetOptions + 4, &options);
  LOG_VERBOSE("recv set options size=%d", options.size());

+  if (options.size() % 2 != 0) {
+    LOG_ERR("options are the incorrect size, can not process them");
+    return;
+  }
+
  // forward
  m_client->setOptions(options);

Source: GitHub commit 8266fbbe

cpp

// Security patch in src/lib/client/Client.cpp
// fix: Check options array is always an even size
 void Client::setOptions(const OptionsList &options)
 {
+  if (options.size() % 2 != 0) {
+    LOG_ERR("options are the incorrect size, can not process them");
+    return;
+  }
+
   for (auto index = options.begin(); index != options.end(); ++index) {
     const OptionID id = *index;
     if (id == kOptionClipboardSharing) {

Source: GitHub commit 8266fbbe

Detection Methods for CVE-2026-63409

Indicators of Compromise

Unexpected crashes of the Deskflow client process shortly after connecting to a server
Client log entries showing abnormal termination during parseHandshakeMessage or setOptions processing
Deskflow servers on the network operating from unexpected hosts, MAC addresses, or non-approved subnets
Repeated failed reconnect attempts from clients to a single server endpoint

Detection Strategies

Monitor process termination events for the Deskflow client binary and correlate with recent inbound TCP sessions on the Deskflow port (default 24800)
Inspect network traffic for kMsgDSetOptions (DSOP) messages carrying odd-count option arrays
Track Deskflow client version inventory to identify hosts still running builds between 1.17.0 and pre-1.26.0.296

Monitoring Recommendations

Alert on unauthorized Deskflow servers advertising on internal networks
Log and review all Deskflow client-to-server connections crossing trust boundaries
Correlate client crash telemetry with concurrent network sessions to identify malicious server behavior

How to Mitigate CVE-2026-63409

Immediate Actions Required

Upgrade all Deskflow client installations to continuous build 1.26.0.296 or later
Restrict Deskflow traffic to trusted hosts only using host firewall rules on the client
Audit endpoints for unauthorized Deskflow installations across managed workstations

Patch Information

The fix is available in Deskflow continuous build 1.26.0.296. It adds an even-size check to both ServerProxy::setOptions() and Client::setOptions() so that odd-length options vectors are rejected with an error log rather than iterated. See the GitHub Security Advisory GHSA-gmvh-3c73-m5gg and the remediation commit for full details.

Workarounds

Connect Deskflow clients only to servers on isolated, trusted network segments
Use host-based firewall rules to allow inbound and outbound Deskflow traffic only from explicitly approved server IP addresses
Disable or uninstall Deskflow on endpoints where keyboard and mouse sharing is not required until the patched build is deployed

bash

# Example: restrict Deskflow client connections to a single trusted server (Linux/iptables)
iptables -A OUTPUT -p tcp --dport 24800 -d 10.0.0.10 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 24800 -j DROP