CVE catalog

CVE-2026-65832

DEBIAN-CVE-2026-65832

[CVE catalog]

Severity
High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 25, 2026

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandeskflow131.22.0+dfsg-7vulnerable
Debiandeskflow131.23.0+dfsg-1vulnerable
Debiandeskflow131.23.0+dfsg-2vulnerable
Debiandeskflow131.24.0+dfsg-1vulnerable
Debiandeskflow131.24.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-1vulnerable
Debiandeskflow131.25.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-1vulnerable
Debiandeskflow131.26.0+dfsg-2vulnerable
Debiandeskflow131.26.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-4vulnerable
Debiandeskflow131.26.0+dfsg-5vulnerable
Debiandeskflow131.27.0+dfsg-1vulnerable
Debiandeskflow141.22.0+dfsg-7vulnerable
Debiandeskflow141.23.0+dfsg-1vulnerable
Debiandeskflow141.23.0+dfsg-2vulnerable
Debiandeskflow141.24.0+dfsg-1vulnerable
Debiandeskflow141.24.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-1vulnerable
Debiandeskflow141.25.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-3vulnerable
Debiandeskflow141.26.0+dfsg-1vulnerable
Debiandeskflow141.26.0+dfsg-2vulnerable
Debiandeskflow141.26.0+dfsg-3vulnerable
Debiandeskflow141.26.0+dfsg-4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandeskflowdeb141.26.0+dfsg-4Not reportedDEBIAN-CVE-2026-65832Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [deskflow]Affected
    Details (2)

    • 1.22.0+dfsg-7 · amd64 · trixie

      Affected

      pypi · deskflow · debian · 13

    • 1.22.0+dfsg-7 · arm64 · trixie

      Affected

      pypi · deskflow · debian · 13

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]