Vulnerability Description
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592a
- https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d1
- https://github.com/deskflow/deskflow/security/advisories/GHSA-jf7g-qghg-p54x
FAQ
What is CVE-2026-65976?
CVE-2026-65976 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflo...
How severe is CVE-2026-65976?
CVE-2026-65976 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65976?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.