Remote Memory-Safety Vulnerability in Deskflow by Deskflow Technologies

CVE-2026-41476

What is CVE-2026-41476?

A remote memory-safety vulnerability exists in Deskflow, a keyboard and mouse sharing application, prior to version 1.26.0.138. The vulnerability arises from improper validation during clipboard deserialization, allowing a connected peer to exploit this weakness by sending a malformed clipboard update. Specifically, the implementation fails to validate the internal structure of the clipboard data, leading to potential out-of-bounds read scenarios. This flaw is due to insufficient checks in ClipboardChunk::assemble(), as it only validates the outer clipboard transfer size, missing critical internal validations. Users are advised to update to version 1.26.0.138 to mitigate this risk.

References