CVE-2026-65832 Memory corruption in deskflow
A remote unauthenticated server can trigger out-of-bounds reads in Deskflow clients, leading to memory disclosure or application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65832?
CVE-2026-65832 is a high-severity memory corruption vulnerability in deskflow, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.
Which versions are affected by CVE-2026-65832?
How do I fix CVE-2026-65832?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-65832 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65832 exists.
Sources
Also known as DEBIAN-CVE-2026-65832, GHSA-8rcq-7w87-h64j, UBUNTU-CVE-2026-65832.