Bug 2517641 (CVE-2026-65832) - CVE-2026-65832 deskflow: Deskflow: Information disclosure and denial of service via unauthenticated out-of-bounds read
Summary: CVE-2026-65832 deskflow: Deskflow: Information disclosure and denial of servi...
Keywords:
Status: NEW
Alias: CVE-2026-65832
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2521886 2521887
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-17 21:12 UTC by OSIDB Bzimport
Modified: 2026-08-24 13:24 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-17 21:12:00 UTC 
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
Note You need to log in before you can comment on or make changes to this bug.