CVE catalog

CVE-2026-41476

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds rea

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

A flaw was found in Deskflow, a keyboard and mouse sharing application. A remote attacker, by sending a specially crafted clipboard update, could exploit a memory-safety vulnerability during clipboard deserialization. This flaw, an out-of-bounds read, could lead to information disclosure or potentially further compromise of the affected system. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpedeskflowNot reported1.26.0.138fixed
Debiandeskflow131.22.0+dfsg-7vulnerable
Debiandeskflow131.23.0+dfsg-1vulnerable
Debiandeskflow131.23.0+dfsg-2vulnerable
Debiandeskflow131.24.0+dfsg-1vulnerable
Debiandeskflow131.24.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-1vulnerable
Debiandeskflow131.25.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-1vulnerable
Debiandeskflow131.26.0+dfsg-2vulnerable
Debiandeskflow131.26.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-4vulnerable
Debiandeskflow131.26.0+dfsg-5vulnerable
Debiandeskflow141.22.0+dfsg-7vulnerable
Debiandeskflow141.23.0+dfsg-1vulnerable
Debiandeskflow141.23.0+dfsg-2vulnerable
Debiandeskflow141.24.0+dfsg-1vulnerable
Debiandeskflow141.24.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-1vulnerable
Debiandeskflow141.25.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-3vulnerable
Debiandeskflow141.26.0+dfsg-1vulnerable
Debiandeskflow141.26.0+dfsg-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpedeskflowcpeNot reported1.26.0.138Not reportedNot reportedNot reported
Debiandeskflowdeb141.26.0+dfsg-2Not reportedDEBIAN-CVE-2026-41476Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [deskflow]Affected
    Details (2)

    • 1.22.0+dfsg-7 · amd64 · trixie

      Affected

      nvd · deskflow · debian · 13

    • 1.22.0+dfsg-7 · arm64 · trixie

      Affected

      nvd · deskflow · debian · 13

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]