CVE-2026-65832

Name of the Vulnerable Software and Affected Versions Deskflow versions prior to 1.26.0.299

Description A remote unauthenticated server can send kMsgDSetOptions (DSOP) values to the setOptions() function in src/lib/client/ServerProxy.cpp. This action poisons the m modifierTranslationTable, leading the translateKey() or translateModifierMask() functions to index the s translationTable or s masks arrays out of bounds. This can result in the disclosure of four bytes at a relative offset selected by the attacker or cause the connected client to crash. Additionally, providing an odd option count triggers an out-of-bounds read of the OptionsList.

Recommendations Update to continuous build 1.26.0.299.