Description

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-17T21:16:46.750Z",
  "pubdate": "2026-08-17T21:16:46.750Z",
  "executiveSummary": "Deskflow versions prior to continuous build 1.26.0.299 are vulnerable to an out-of-bounds memory read and potential denial of service vulnerability caused by improper input validation.\nThe vulnerability allows a remote, unauthenticated Deskflow server to send malicious configuration data that poisons internal translation tables.\nThis flaw impacts client instances connecting to untrusted servers, enabling unauthorized disclosure of four bytes of memory at an attacker-selected relative offset or triggering an application crash.\nThe attack requires network connectivity between a malicious server and a victim client, exploiting the protocol parsing logic during the option setting phase without requiring prior authentication or user privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in the ServerProxy::setOptions() function located within src/lib/client/ServerProxy.cpp.\nA remote unauthenticated Deskflow server can transmit arbitrary kMsgDSetOptions (DSOP) values to the client.\nDuring processing, the value following a modifier option directly poisons the m_modifierTranslationTable data structure.\nSubsequent invocations of ServerProxy::translateKey() or ServerProxy::translateModifierMask() utilize this poisoned table to index out of bounds into the static seven-row s_translationTable or s_masks arrays.\nAdditionally, providing an odd option count triggers an out-of-bounds read within the OptionsList parsing logic.\nThe attack flow proceeds as follows: 1) A malicious remote server establishes communication with a Deskflow client. 2) The server transmits a crafted kMsgDSetOptions message containing malicious modifier values and an arbitrary option count. 3) The client processes the message in ServerProxy::setOptions(), leading to the poisoning of m_modifierTranslationTable. 4) When the client attempts to translate keys or modifier masks via translateKey() or translateModifierMask(), the out-of-bounds indexing occurs. 5) This results in either the disclosure of four bytes of adjacent memory at an attacker-controlled relative offset or a segmentation fault, causing a client crash.\nThe vulnerable component is the option parsing and translation mechanism in src/lib/client/ServerProxy.cpp.\nThe affected product is Deskflow prior to continuous build 1.26.0.299.\nExploitation requires network exposure where a client connects to an attacker-controlled or compromised server, with no authentication or user privileges required."
}