Deskflow
Monthly
Out-of-bounds memory read in Deskflow clients prior to continuous build 1.26.0.299 allows a network-reachable malicious server to crash the connected client or disclose up to four bytes of client process memory at an attacker-controlled relative offset. The flaw lives in ServerProxy::setOptions(), where crafted kMsgDSetOptions (DSOP) option values corrupt m_modifierTranslationTable indexes that translateKey() and translateModifierMask() then use to index static seven-row lookup arrays beyond their valid bounds. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no client-side user interaction beyond an established server connection.
Out-of-bounds read in Deskflow's client-side `ServerProxy::setOptions()` allows a malicious Deskflow server to crash any connected client by sending an odd-length DSOP options vector during the handshake sequence. Affected releases span from 1.17.0 through all continuous builds before 1.26.0.296, covering the full client codebase across five source files. No active exploitation is listed in CISA KEV and no public exploit code has been identified, though the crash is deterministic and the CVSS C:L component reflects marginal heap/stack memory disclosure from the out-of-bounds read.
Remote denial of service in Deskflow servers (versions prior to 1.26.0.167) running with TLS enabled - the default - lets any unauthenticated TCP peer stall input delivery to all connected screens. Because SecureSocket::secureAccept calls a blocking Arch::sleep(1) on the single multiplexer worker thread whenever a connection's first bytes fail to parse as a valid TLS ClientHello, one malformed handshake freezes mouse, keyboard, and clipboard traffic for ~1 second, and a sustained drip of ≥1 bad connection per second renders the server unusable. EPSS is low (0.04%, 12th percentile) and there is no public exploit identified at time of analysis, though the fix commit is public and the trigger is trivial.
Local privilege escalation in Deskflow (all versions up to 1.20.0 stable and 1.26.0.134 continuous) allows any low-privilege Windows user to execute arbitrary commands as SYSTEM by accessing an unauthenticated IPC named pipe. The daemon runs with SYSTEM privileges and processes commands without validating caller identity due to WorldAccessOption configuration. No public exploit identified at time of analysis, but the attack vector is straightforward for local users with basic Windows IPC knowledge.
Out-of-bounds memory read in Deskflow's clipboard deserialization allows authenticated remote peers to crash the application or potentially leak memory contents. The vulnerability affects versions prior to 1.26.0.138 and stems from insufficient validation of clipboard data structure during network transfer between connected machines. A malicious peer on the shared keyboard/mouse network can exploit this by sending specially crafted clipboard updates. CVSS 7.4 reflects network-based attack with low complexity requiring authenticated peer connection. No public exploit identified at time of analysis, though proof-of-concept code exists (CVSS E:P).
Memory exhaustion in Deskflow's clipboard protocol subsystem allows a connected peer to crash the receiving process by flooding it with DataChunk messages that accumulate beyond the declared DataStart size before any DataEnd validation occurs. Versions 1.17.0 through continuous build 1.26.0.299 are affected on both server (ClientProxy1_6.cpp) and client (ServerProxy.cpp) code paths. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack primitive is straightforward given the publicly available patch diff.
Out-of-bounds memory read in Deskflow clients prior to continuous build 1.26.0.299 allows a network-reachable malicious server to crash the connected client or disclose up to four bytes of client process memory at an attacker-controlled relative offset. The flaw lives in ServerProxy::setOptions(), where crafted kMsgDSetOptions (DSOP) option values corrupt m_modifierTranslationTable indexes that translateKey() and translateModifierMask() then use to index static seven-row lookup arrays beyond their valid bounds. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no client-side user interaction beyond an established server connection.
Out-of-bounds read in Deskflow's client-side `ServerProxy::setOptions()` allows a malicious Deskflow server to crash any connected client by sending an odd-length DSOP options vector during the handshake sequence. Affected releases span from 1.17.0 through all continuous builds before 1.26.0.296, covering the full client codebase across five source files. No active exploitation is listed in CISA KEV and no public exploit code has been identified, though the crash is deterministic and the CVSS C:L component reflects marginal heap/stack memory disclosure from the out-of-bounds read.
Remote denial of service in Deskflow servers (versions prior to 1.26.0.167) running with TLS enabled - the default - lets any unauthenticated TCP peer stall input delivery to all connected screens. Because SecureSocket::secureAccept calls a blocking Arch::sleep(1) on the single multiplexer worker thread whenever a connection's first bytes fail to parse as a valid TLS ClientHello, one malformed handshake freezes mouse, keyboard, and clipboard traffic for ~1 second, and a sustained drip of ≥1 bad connection per second renders the server unusable. EPSS is low (0.04%, 12th percentile) and there is no public exploit identified at time of analysis, though the fix commit is public and the trigger is trivial.
Local privilege escalation in Deskflow (all versions up to 1.20.0 stable and 1.26.0.134 continuous) allows any low-privilege Windows user to execute arbitrary commands as SYSTEM by accessing an unauthenticated IPC named pipe. The daemon runs with SYSTEM privileges and processes commands without validating caller identity due to WorldAccessOption configuration. No public exploit identified at time of analysis, but the attack vector is straightforward for local users with basic Windows IPC knowledge.
Out-of-bounds memory read in Deskflow's clipboard deserialization allows authenticated remote peers to crash the application or potentially leak memory contents. The vulnerability affects versions prior to 1.26.0.138 and stems from insufficient validation of clipboard data structure during network transfer between connected machines. A malicious peer on the shared keyboard/mouse network can exploit this by sending specially crafted clipboard updates. CVSS 7.4 reflects network-based attack with low complexity requiring authenticated peer connection. No public exploit identified at time of analysis, though proof-of-concept code exists (CVSS E:P).
Memory exhaustion in Deskflow's clipboard protocol subsystem allows a connected peer to crash the receiving process by flooding it with DataChunk messages that accumulate beyond the declared DataStart size before any DataEnd validation occurs. Versions 1.17.0 through continuous build 1.26.0.299 are affected on both server (ClientProxy1_6.cpp) and client (ServerProxy.cpp) code paths. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack primitive is straightforward given the publicly available patch diff.