CVE catalog

CVE-2026-63409

DEBIAN-CVE-2026-63409

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.45% · Oct 25, 2026

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandeskflow131.22.0+dfsg-7vulnerable
Debiandeskflow131.23.0+dfsg-1vulnerable
Debiandeskflow131.23.0+dfsg-2vulnerable
Debiandeskflow131.24.0+dfsg-1vulnerable
Debiandeskflow131.24.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-1vulnerable
Debiandeskflow131.25.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-1vulnerable
Debiandeskflow131.26.0+dfsg-2vulnerable
Debiandeskflow131.26.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-4vulnerable
Debiandeskflow131.26.0+dfsg-5vulnerable
Debiandeskflow141.22.0+dfsg-7vulnerable
Debiandeskflow141.23.0+dfsg-1vulnerable
Debiandeskflow141.23.0+dfsg-2vulnerable
Debiandeskflow141.24.0+dfsg-1vulnerable
Debiandeskflow141.24.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-1vulnerable
Debiandeskflow141.25.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-3vulnerable
Debiandeskflow141.26.0+dfsg-1vulnerable
Debiandeskflow141.26.0+dfsg-2vulnerable
Debiandeskflow141.26.0+dfsg-3vulnerable
Debiandeskflow141.26.0+dfsg-4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandeskflowdeb141.26.0+dfsg-4Not reportedDEBIAN-CVE-2026-63409Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [deskflow]Affected
    Details (2)

    • 1.22.0+dfsg-7 · amd64 · trixie

      Affected

      pypi · deskflow · debian · 13

    • 1.22.0+dfsg-7 · arm64 · trixie

      Affected

      pypi · deskflow · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]