CVE-2026-65832

The record

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.

Affected packages

Related vulnerabilities

• CVE-2026-92824 A flaw was found in libmodulemd. CWE-125
• CVE-2026-114038 A flaw was found in device-mapper-multipath. CWE-125
• CVE-2026-112896 Pillow is a Python imaging library. CWE-125
• CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in… CWE-125
• CVE-2026-112273 libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name… CWE-125
• CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-125
• CVE-2026-112020 LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in… CWE-125
• CVE-2026-88842 A flaw was found in BusyBox dpkg. CWE-125