{"id":"CVE-2026-65832","summary":"Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing","details":"Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.","aliases":["GHSA-8rcq-7w87-h64j"],"modified":"2026-09-11T08:26:22.476596Z","published":"2026-08-17T20:59:08.714Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-129"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65832.json","unresolved_ranges":[{"extracted_events":[{"fixed":"1.26.0.299"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65832.json"},{"type":"ADVISORY","url":"https://github.com/deskflow/deskflow/security/advisories/GHSA-8rcq-7w87-h64j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65832"},{"type":"FIX","url":"https://github.com/deskflow/deskflow/commit/205a3c803e5298d56683660736ec1a41b671b56e"},{"type":"FIX","url":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/deskflow/deskflow","events":[{"introduced":"0"},{"fixed":"205a3c803e5298d56683660736ec1a41b671b56e"},{"fixed":"8266fbbe6af93fa370018886c7f1f35d2cee8b3f"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.0","v1.18.0","v1.17.2","v1.17.1","v1.17.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65832.json","vanir_signatures_modified":"2026-09-11T08:26:22Z","vanir_signatures":[{"target":{"file":"src/lib/server/ClientProxy1_0.cpp"},"deprecated":false,"digest":{"line_hashes":["59296496970081143490392020132113578308","264147184473189989835777453027769399669","105461901912855228587267469831660350127","84147866730353443619115107668400347161"],"threshold":0.9},"id":"CVE-2026-65832-03a42dcc","signature_type":"Line","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f"},{"deprecated":false,"digest":{"line_hashes":["236976754671402044676543928600241033718","301820332396168299652958655454656578282","75656020767226221753543808461534719015","88737114258928579320783421213981706439"],"threshold":0.9},"id":"CVE-2026-65832-11dad1d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/client/Client.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/deskflow/Screen.cpp"},"deprecated":false,"digest":{"line_hashes":["93452003649932511260159433311084409086","247688328563674058561963965487937275917","222930386684317508431460109957809265988","28762715122451522537557181752956634048"],"threshold":0.9},"id":"CVE-2026-65832-40e33c37"},{"source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/platform/XWindowsScreen.cpp","function":"XWindowsScreen::setOptions"},"deprecated":false,"digest":{"function_hash":"242150540230015351880935572870261266256","length":529},"id":"CVE-2026-65832-4211de9e","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/client/ServerProxy.cpp","function":"ServerProxy::setOptions"},"deprecated":false,"digest":{"function_hash":"46660015884301948534165028696470585037","length":1125},"id":"CVE-2026-65832-57e2ac2f","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["34153358309916817461995184018916692635","177866724128377571376130959453194049113","170436926807622728606035106478103507819"],"threshold":0.9},"id":"CVE-2026-65832-6859f86c","signature_type":"Line","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/client/ServerProxy.cpp"},"deprecated":false},{"id":"CVE-2026-65832-782ff0b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/205a3c803e5298d56683660736ec1a41b671b56e","target":{"file":"src/lib/client/ServerProxy.cpp","function":"ServerProxy::translateKey"},"deprecated":false,"digest":{"function_hash":"261226382722752607858100778307096721936","length":1277}},{"signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/205a3c803e5298d56683660736ec1a41b671b56e","target":{"file":"src/lib/client/ServerProxy.cpp","function":"ServerProxy::setOptions"},"deprecated":false,"digest":{"function_hash":"94722876080374788613256545747640234875","length":1239},"id":"CVE-2026-65832-7b132dbe","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/client/Client.cpp","function":"Client::setOptions"},"deprecated":false,"digest":{"function_hash":"312139493942473756410202906392974875075","length":915},"id":"CVE-2026-65832-7d19d0e5","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"182292245178790624035897408450002214698","length":1070},"id":"CVE-2026-65832-8e253a6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/205a3c803e5298d56683660736ec1a41b671b56e","target":{"file":"src/lib/client/ServerProxy.cpp","function":"ServerProxy::translateModifierMask"}},{"signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/205a3c803e5298d56683660736ec1a41b671b56e","target":{"file":"src/lib/client/ServerProxy.cpp"},"deprecated":false,"digest":{"line_hashes":["175205234490161571838626610441437009286","249705590553029667353764769953550181372","88163038393294233228499835643644729349","292981310238654252366773930625587870521","36356337406533131034490070336206601269","154961504526017195290306251453683321445","128754472439299004634282977669166588559","192913350536411493559187997163713044605","116374645989681397566088937809810758519","303928164837789552356284542764629944678","148695111133185058279980010079884371005","47756511842713960850080859647655144205","266675220807083210240169962424665695628","186658488761535777642335669680542987440"],"threshold":0.9},"id":"CVE-2026-65832-90dff539","signature_type":"Line"},{"digest":{"function_hash":"104530485550888798731996742964881974822","length":541},"id":"CVE-2026-65832-929b8799","signature_type":"Function","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/server/ClientProxy1_0.cpp","function":"ClientProxy1_0::setOptions"},"deprecated":false},{"id":"CVE-2026-65832-a61be1d9","signature_type":"Function","signature_version":"v1","source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/deskflow/Screen.cpp","function":"Screen::setOptions"},"deprecated":false,"digest":{"function_hash":"18947052360808800384892180812294548188","length":1080}},{"source":"https://github.com/deskflow/deskflow/commit/8266fbbe6af93fa370018886c7f1f35d2cee8b3f","target":{"file":"src/lib/platform/XWindowsScreen.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["273541962625817997133142657194574257165","202300633054273446961833766744508583768","337889412725806583931295026569644801833","26441519965697055416038752529846435248"]},"id":"CVE-2026-65832-aa93e63b","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}]}