Description

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-17T21:16:46.200Z",
  "pubdate": "2026-08-17T21:16:46.200Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the keyboard and mouse sharing application Deskflow, affecting versions from 1.17.0 until continuous build 1.26.0.296. The vulnerability arises from improper handling of odd-length DSOP vectors within the handshake parsing logic. A malicious Deskflow server can exploit this flaw by transmitting a specially crafted, odd-length vector to a connected client, leading to memory access violations beyond the intended data boundary during option processing. The primary impact of this vulnerability is a denial of service resulting from the abnormal termination or crash of the connected client application. The risk implication involves potential disruption of user workflows in multi-machine environments where users rely on shared peripherals managed by Deskflow. To successfully execute this attack, an attacker requires the capabilities of a malicious server interacting with a connecting client during the handshake phase. No specific authentication or privilege requirements beyond establishing a network connection between the server and the client are mentioned in the exploitation vector. The vulnerability is fully remediated in continuous build 1.26.0.296 through proper input validation and boundary checks during vector processing.",
  "technicalDetails": "The vulnerability resides in the ServerProxy::setOptions() function located within src/lib/client/ServerProxy.cpp in Deskflow. The root cause of the issue is an insecure assumption regarding the structural integrity and expected length of DSOP vectors processed during the initial handshake sequence. Specifically, when a malicious Deskflow server sends an odd-length DSOP vector, the parsing logic fails to account for the missing value following the final option key. Consequently, when the data flows through the execution chain from PacketStreamFilter::filterEvent to ServerProxy::handleData() and subsequently into ServerProxy::parseHandshakeMessage(), the application attempts to read memory beyond the allocated bounds of the vector. This out-of-bounds read condition triggers an immediate access violation, forcing the client process to crash and terminating the network session. The vulnerable component is the handshake message parser within the client-side proxy implementation, which processes unauthenticated or untrusted input received over the network from a connected server. The affected software versions span from version 1.17.0 up to, but not including, continuous build 1.26.0.296. Network exposure is inherent to the application architecture, as Deskflow functions by establishing network connections to share input peripherals across systems. Step-by-step, exploitation occurs when a client initiates or accepts a connection with a malicious server, the server transmits a maliciously formatted handshake payload containing an odd-length DSOP vector, the data stream is filtered and passed to the data handling routines, and the parser attempts to read the truncated final option value, crossing memory boundaries and crashing the client application. The post-exploitation impact is strictly limited to denial of service via application termination, as arbitrary code execution or data exfiltration vectors are not indicated by the mechanics of an out-of-bounds read during this specific parsing routine."
}