CVE catalog

CVE-2026-65976

DEBIAN-CVE-2026-65976

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.45% · Oct 25, 2026

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandeskflow131.22.0+dfsg-7vulnerable
Debiandeskflow131.23.0+dfsg-1vulnerable
Debiandeskflow131.23.0+dfsg-2vulnerable
Debiandeskflow131.24.0+dfsg-1vulnerable
Debiandeskflow131.24.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-1vulnerable
Debiandeskflow131.25.0+dfsg-2vulnerable
Debiandeskflow131.25.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-1vulnerable
Debiandeskflow131.26.0+dfsg-2vulnerable
Debiandeskflow131.26.0+dfsg-3vulnerable
Debiandeskflow131.26.0+dfsg-4vulnerable
Debiandeskflow131.26.0+dfsg-5vulnerable
Debiandeskflow141.22.0+dfsg-7vulnerable
Debiandeskflow141.23.0+dfsg-1vulnerable
Debiandeskflow141.23.0+dfsg-2vulnerable
Debiandeskflow141.24.0+dfsg-1vulnerable
Debiandeskflow141.24.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-1vulnerable
Debiandeskflow141.25.0+dfsg-2vulnerable
Debiandeskflow141.25.0+dfsg-3vulnerable
Debiandeskflow141.26.0+dfsg-1vulnerable
Debiandeskflow141.26.0+dfsg-2vulnerable
Debiandeskflow141.26.0+dfsg-3vulnerable
Debiandeskflow141.26.0+dfsg-4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandeskflowdeb141.26.0+dfsg-4Not reportedDEBIAN-CVE-2026-65976Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [deskflow]Affected
    Details (2)

    • 1.22.0+dfsg-7 · amd64 · trixie

      Affected

      pypi · deskflow · debian · 13

    • 1.22.0+dfsg-7 · arm64 · trixie

      Affected

      pypi · deskflow · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]