CVE-2026-65976

Received Received - Intake

Clipboard Memory Exhaustion in Deskflow

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-65976

Affected Vendors & Products

Vendor	Product	Version / Range
deskflow	deskflow	From 1.17.0 (inc) to 1.26.0.300 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Deskflow allows a connected peer to send repeated DCLP DataChunk messages that cause the server or client to append data beyond the declared size and clipboard limit before validation. This exhausts receiver memory.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal clipboard data traffic or memory exhaustion on systems running Deskflow versions between 1.17.0 and 1.26.0.300. Check Deskflow logs for repeated DCLP DataChunk messages or unexpected clipboard size increases. Use system monitoring tools to detect memory exhaustion events.

Impact Analysis

An attacker could exploit this to crash the Deskflow application by consuming all available memory on the receiver's system, leading to denial of service.

Mitigation Strategies

Upgrade Deskflow to continuous build 1.26.0.300 or later immediately. If upgrading is not possible, restrict network access to Deskflow ports or disable clipboard sharing functionality until the update is applied.

Hi! I’m here to help you understand CVE-2026-65976. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70