CVE-2026-63409

Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client

8.2 HighFix available

CVE-2026-63409 is a high vulnerability (CVSS 8.2) in Deskflow, published August 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in deskflow 1.26.0+dfsg-4.

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: High

Exploit likelihood

0.45%Up 0.2 points since Aug 18, 2026

What each source reports

CVE List Score used 8.2

Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client

Record: CVE-2026-63409
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2026-60463 8.2

Record: EUVD-2026-60463
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

NVD 8.2

Record: CVE-2026-63409
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 8.2

Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client

Record: CVE-2026-63409
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-63409 8.2

Record: DEBIAN-CVE-2026-63409
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-63409 8.2

Record: UBUNTU-CVE-2026-63409
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

Affected products

deskflow

Affected packages

Affected packages
Package	Affected	Fixed
`deskflow` Debian:13	All versions, plus listed versions 1.22.0+dfsg-71.23.0+dfsg-11.23.0+dfsg-21.24.0+dfsg-11.24.0+dfsg-2 Show 8 moreShow less 1.25.0+dfsg-11.25.0+dfsg-21.25.0+dfsg-31.26.0+dfsg-11.26.0+dfsg-21.26.0+dfsg-31.26.0+dfsg-41.26.0+dfsg-5	None known
`deskflow` Debian:14	before 1.26.0+dfsg-4, plus listed versions 1.22.0+dfsg-71.23.0+dfsg-11.23.0+dfsg-21.24.0+dfsg-11.24.0+dfsg-2 Show 6 moreShow less 1.25.0+dfsg-11.25.0+dfsg-21.25.0+dfsg-31.26.0+dfsg-11.26.0+dfsg-21.26.0+dfsg-3	1.26.0+dfsg-4
`deskflow` Ubuntu:26.10	All versions, plus listed versions 1.26.0+dfsg-11.26.0+dfsg-31.26.0+dfsg-5ubuntu11.27.0+dfsg-1	None known
`deskflow` Ubuntu:26.04:LTS	All versions, plus listed versions 1.23.0+dfsg-11.24.0+dfsg-21.25.0+dfsg-21.25.0+dfsg-31.26.0+dfsg-1	None known

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, NVD, OSV