CVE-2026-63409 Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client
A malicious server can crash the Deskflow client by sending an odd-length options vector, causing an out-of-bounds read.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63409?
CVE-2026-63409 is a high-severity memory corruption vulnerability in deskflow, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.
Weakness: CWE-125
Which versions are affected by CVE-2026-63409?
How do I fix CVE-2026-63409?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-63409 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63409 exists.
Sources
Also known as DEBIAN-CVE-2026-63409, GHSA-gmvh-3c73-m5gg, UBUNTU-CVE-2026-63409.