CVE-2026-41477

Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAccessOption enabled. The daemon processes privileged commands without authentication, allowing any local unprivileged user to execute arbitrary...

CVE-2026-41476 Deskflow: clipboard deserialization global-buffer-overflow

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The issue is in the implementation of...

EUVD-2026-25622

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The issue is in the implementation of...

CVE-2026-41476

Deskflow is affected by a remote memory-safety vulnerability in clipboard deserialization prior to version 1.26.0.138. The flaw resides in IClipboard.cpp and ClipboardChunk.cpp where ClipboardChunk::assemble() validates only the outer transfer size, allowing malformed inner clipboard blob lengths...

CVE-2026-41476 Deskflow: clipboard deserialization global-buffer-overflow

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The issue is in the implementation of...

CVE-2026-41476

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The issue is in the implementation of...

CVE-2026-41477: Missing Authentication for Critical Function

Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAccessOption enabled. The daemon processes privileged commands without authentication, allowing any local unprivileged user to execute arbitrary...

Deskflow Access Control Vulnerability

Deskflow is an open-source tool for sharing keyboards and mice across devices. Versions of Deskflow such as 1.20.0, 1.26.0.134, and earlier had access control vulnerabilities. These vulnerabilities stemmed from the Deskflow daemon running as the SYSTEM account, exposing IPC named pipes that have...

PT-2026-35076

Name of the Vulnerable Software and Affected Versions Deskflow versions prior to 1.20.0 Deskflow versions prior to 1.26.0.134 Description The Deskflow daemon runs with SYSTEM privileges and exposes an Inter-Process Communication IPC named pipe with the WorldAccessOption enabled. This configuratio...

deskflow security vulnerability

Deskflow is an open-source tool for sharing keyboards and mice across devices. Versions of Deskflow prior to 1.26.0.138 contained security vulnerabilities. These vulnerabilities stemmed from a remote memory security flaw in clipboard deserialization, allowing connected devices to trigger...

PT-2026-35075

Name of the Vulnerable Software and Affected Versions Deskflow versions prior to 1.26.0.138 Description A remote memory-safety issue in clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The problem exists in the...

CVE-2026-41476: Buffer Copy without Checking Size of Input

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The issue is in the implementation of...