CVE-2026-65832: Deskflow Buffer Overflow Vulnerability

CVE-2026-65832 Overview

Deskflow is an open-source keyboard and mouse sharing application. A remote unauthenticated Deskflow server can send crafted kMsgDSetOptions (DSOP) messages to a connected client, poisoning m_modifierTranslationTable in ServerProxy::setOptions(). Subsequent calls to ServerProxy::translateKey() or ServerProxy::translateModifierMask() then index the seven-row s_translationTable or s_masks arrays out of bounds. The flaw discloses four bytes at an attacker-selected relative offset or crashes the client. An odd option count additionally triggers an out-of-bounds read on OptionsList. The issue is fixed in continuous build 1.26.0.299.

Critical Impact
A malicious or compromised Deskflow server can crash connected clients or leak four bytes of adjacent memory per crafted message without authentication.

Affected Products

Deskflow keyboard and mouse sharing application
Continuous builds prior to 1.26.0.299
Client-side component src/lib/client/ServerProxy.cpp

Discovery Timeline

2026-08-17 - CVE-2026-65832 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-65832

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Deskflow client's option processing path. When a client connects to a Deskflow server, the server can send a kMsgDSetOptions (DSOP) message containing an OptionsList of alternating identifier and value pairs. ServerProxy::setOptions() walks this list and, when it encounters a modifier option, writes the following value into m_modifierTranslationTable without validating the range.

m_modifierTranslationTable is later used as an index into the fixed seven-row s_translationTable array in ServerProxy::translateKey() and into s_masks in ServerProxy::translateModifierMask(). A poisoned index reads memory beyond these arrays. Because the read result is returned to key translation logic, an attacker chooses the relative offset and can extract four bytes of adjacent process memory or force a crash.

Root Cause

Two defects share the root cause. First, Client::setOptions() and ServerProxy::setOptions() did not validate that OptionsList contained an even number of entries. An odd count causes the loop to read one element past the vector. Second, modifier values pulled from the network were used directly as array indices with no clamp against kKeyModifierIDLast, allowing attacker-controlled table lookups.

Attack Vector

Exploitation requires a client to connect to an attacker-controlled Deskflow server or a server that has been compromised or man-in-the-middled on the network. No authentication or user interaction is needed once the connection is established. The attacker sends a crafted DSOP message with an odd option count or with poisoned modifier translation values to trigger the out-of-bounds read.

cpp

// Security patch in src/lib/client/ServerProxy.cpp
// fix: clamp mapped modifiers
  if (id2 != kKeyModifierIDNull) {
-    return s_translationTable[m_modifierTranslationTable[id2]][side];
+    return std::clamp<KeyModifierMask>(
+        s_translationTable[m_modifierTranslationTable[id2]][side], 0, kKeyModifierIDLast - 1
+    );
  } else {
-    return id;
+    return std::clamp<KeyModifierMask>(id, 0, kKeyModifierIDLast - 1);
  }

Source: GitHub Commit 205a3c8

Detection Methods for CVE-2026-65832

Indicators of Compromise

Unexpected Deskflow client crashes shortly after receiving server messages, particularly during option negotiation.
Deskflow log entries reading options are the incorrect size, can not process them on patched clients indicate a malformed DSOP message was received.
Outbound Deskflow client connections to servers outside of approved KVM sharing hosts.

Detection Strategies

Monitor process telemetry for abnormal terminations of the Deskflow client binary and correlate with recent network activity to Deskflow servers.
Inspect network flows for Deskflow protocol traffic (default TCP port 24800) originating from untrusted hosts.
Compare installed Deskflow build identifiers against the fixed build 1.26.0.299 across managed endpoints.

Monitoring Recommendations

Alert on new or unauthorized Deskflow server endpoints appearing in client configurations or connection logs.
Track application error logs from Deskflow for parsing failures and repeated disconnects following option exchange.
Baseline expected Deskflow client-to-server pairings and flag deviations for review.

How to Mitigate CVE-2026-65832

Immediate Actions Required

Upgrade Deskflow to continuous build 1.26.0.299 or later on all client systems.
Restrict Deskflow client connections to trusted, known-good server hosts only.
Audit endpoints for the presence of the Deskflow client and remove installations that are not required.

Patch Information

The fix is delivered across two commits. Commit 205a3c8 clamps mapped modifier values against kKeyModifierIDLast before they are used as array indices. Commit 8266fbb rejects OptionsList payloads with an odd element count in both ServerProxy::setOptions() and Client::setOptions(). See the GitHub Security Advisory GHSA-8rcq-7w87-h64j for advisory details.

cpp

// Security patch in src/lib/client/Client.cpp
// fix: Check options array is always an even size
 void Client::setOptions(const OptionsList &options)
 {
+  if (options.size() % 2 != 0) {
+    LOG_ERR("options are the incorrect size, can not process them");
+    return;
+  }
+
   for (auto index = options.begin(); index != options.end(); ++index) {
     const OptionID id = *index;
     if (id == kOptionClipboardSharing) {

Source: GitHub Commit 8266fbb

Workarounds

Block Deskflow protocol traffic (TCP 24800) at network boundaries from untrusted network segments.
Isolate Deskflow client hosts on management VLANs that only reach approved server hosts.
Disable or uninstall Deskflow on endpoints that do not require KVM sharing until the patched build is deployed.

bash

# Configuration example: restrict Deskflow client egress to a trusted server
iptables -A OUTPUT -p tcp --dport 24800 -d 10.0.0.10 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 24800 -j DROP