CVE-2026-65976: Deskflow Memory Exhaustion DOS Vulnerability

CVE-2026-65976 Overview

Deskflow is an open-source keyboard and mouse sharing application. A resource exhaustion vulnerability [CWE-400] affects Deskflow versions from 1.17.0 until continuous build 1.26.0.300. A connected peer can transmit repeated Deskflow Clipboard Protocol (DCLP) DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp. The server path in src/lib/server/ClientProxy1_6.cpp and the client path in src/lib/client/ServerProxy.cpp append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation occurs. This behavior exhausts receiver memory and terminates the process. The issue is fixed in continuous build 1.26.0.300.

Critical Impact
A connected peer can exhaust receiver memory on Deskflow client or server processes by sending oversized clipboard chunks, causing denial of service.

Affected Products

Deskflow continuous builds from 1.17.0 up to (but not including) 1.26.0.300
Deskflow server path (src/lib/server/ClientProxy1_6.cpp)
Deskflow client path (src/lib/client/ServerProxy.cpp)

Discovery Timeline

2026-08-17 - CVE-2026-65976 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-65976

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw in Deskflow's clipboard synchronization protocol. Deskflow transmits clipboard content between peers as a stream of DCLP messages framed by DataStart, one or more DataChunk messages, and a final DataEnd. The assembly function ClipboardChunk::assemble() appends each incoming DataChunk to an in-memory buffer.

The function does not enforce the size declared in DataStart or the configured clipboard limit while chunks arrive. Size validation occurs only after DataEnd is received. A malicious peer can send an unbounded stream of DataChunk messages and force the receiving process to allocate memory until it is terminated by the operating system.

Both roles are affected. A malicious client can exhaust a Deskflow server, and a malicious or spoofed server can exhaust a connected client.

Root Cause

The root cause is missing runtime enforcement of the declared payload size and clipboard size ceiling during chunk reassembly. ClipboardChunk::assemble() deferred validation to DataEnd processing, allowing intermediate DataChunk messages to grow the receive buffer without bound.

Attack Vector

Exploitation requires network reachability to the Deskflow listener and successful peering, plus user interaction to accept the connection. Once connected, the attacker sends a DataStart followed by an arbitrary number of DataChunk frames larger than the declared or configured clipboard size, without ever sending DataEnd.

The following patch introduces an explicit receive-side clipboard limit accessor used to bound reassembly:

cpp

   return m_serverAddress;
 }
 
+size_t Client::getMaximumClipboardSizeBytes() const
+{
+  return m_maximumClipboardSize * 1024;
+}
+
 void *Client::getEventTarget() const
 {
   return m_screen->getEventTarget();

Source: GitHub Commit 8a535fd5

A follow-up patch replaces the shared limit with a locally configured receive size, ensuring the client uses its own clipboard ceiling instead of one negotiated with the peer:

cpp

       m_socketFactory(socketFactory),
       m_screen(screen),
       m_events(events),
-      m_useSecureNetwork(Settings::value(Settings::Security::TlsEnabled).toBool())
+      m_useSecureNetwork(Settings::value(Settings::Security::TlsEnabled).toBool()),
+      m_maximumClipboardReceiveSize(
+          static_cast<size_t>(Settings::value(Settings::Server::ClipboardSize).toUInt()) * 1024 * 1024
+      )
 {
   assert(m_socketFactory != nullptr);
   assert(m_screen != nullptr);

Source: GitHub Commit bcd3a658

Detection Methods for CVE-2026-65976

Indicators of Compromise

Deskflow server or client processes terminating unexpectedly or being killed by the operating system out-of-memory (OOM) killer.
Sudden spikes in resident memory for the deskflow-server or deskflow-client processes without corresponding user activity.
Long-lived Deskflow sessions from unexpected peers on TCP port 24800.

Detection Strategies

Monitor process memory metrics for Deskflow binaries and alert when working set exceeds the configured clipboard size ceiling.
Inspect operating system logs for OOM events referencing Deskflow processes.
Baseline expected peers and alert on new inbound connections to the Deskflow listener from unapproved sources.

Monitoring Recommendations

Enable per-process memory accounting and log peak RSS for Deskflow services.
Capture network flow telemetry for TCP port 24800 and correlate connection duration with memory growth on the host.
Track patch inventory for continuous build 1.26.0.300 or later across systems running Deskflow.

How to Mitigate CVE-2026-65976

Immediate Actions Required

Upgrade Deskflow to continuous build 1.26.0.300 or later on all client and server hosts.
Restrict Deskflow listener exposure to trusted local networks using host-based firewalls.
Require Transport Layer Security (TLS) and validate peer identities to reduce the risk of unauthorized connections.

Patch Information

The fix is delivered in Deskflow continuous build 1.26.0.300. Commit 8a535fd5 enforces a clipboard receive size limit, and commit bcd3a658 switches the client to a locally configured receive limit. See the GitHub Security Advisory GHSA-jf7g-qghg-p54x for coordinated disclosure details.

Workarounds

Bind the Deskflow listener to a loopback or isolated management interface until the patch is deployed.
Terminate long-running sessions with untrusted peers and refuse peering requests from unknown hosts.
Set a conservative value for Settings::Server::ClipboardSize to reduce the memory ceiling reachable by chunk reassembly.

bash

# Restrict Deskflow to trusted subnet using iptables
iptables -A INPUT -p tcp --dport 24800 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 24800 -j DROP