Description

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T21:16:47.027Z",
  "pubdate": "2026-08-17T21:16:47.027Z",
  "executiveSummary": "Deskflow contains a memory exhaustion vulnerability involving the processing of DCLP DataChunk messages.\nThe vulnerability allows a connected peer to trigger excessive memory allocation, leading to denial of service through resource exhaustion.\nAffected products include Deskflow from version 1.17.0 up to continuous build 1.26.0.300.\nThe risk implication is severe availability degradation of the affected server or client instance due to unvalidated data processing.\nAttacker capabilities require the ability to connect as a peer to the Deskflow service.\nExploitation requires sending maliciously crafted or repeated DCLP DataChunk messages to trigger the flaw before boundary validation occurs.",
  "technicalDetails": "The vulnerability resides in the clipboard data handling logic implemented within src/lib/deskflow/ClipboardChunk.cpp specifically inside the ClipboardChunk::assemble() function.\nThe root cause stems from improper sequencing where the server path in src/lib/server/ClientProxy1_6.cpp or the client path in src/lib/client/ServerProxy.cpp permits data to be appended beyond the declared DataStart size and the configured clipboard limit before executing DataEnd validation.\nA connected peer initiates the attack flow by transmitting repeated DCLP DataChunk messages to the receiving endpoint.\nBecause validation against DataEnd occurs after the append operation, the target application continuously allocates memory to accommodate the incoming stream.\nThis unchecked accumulation bypasses configured clipboard limits and exceeds the declared DataStart size.\nThe affected versions span from 1.17.0 through continuous build 1.26.0.300.\nAuthentication requirements depend on the standard peer connection setup of Deskflow, requiring network reachability to the sharing service.\nThe payload behavior forces the targeted process to consume system memory continuously until resource exhaustion occurs.\nThe post-exploitation impact is limited to denial of service via memory exhaustion, causing crashes or system instability on the affected server or client."
}