{"id":"CVE-2026-65976","aliases":["DEBIAN-CVE-2026-65976","EUVD-2026-60466","GHSA-jf7g-qghg-p54x","UBUNTU-CVE-2026-65976"],"status":"published","title":"Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit","description":"Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00452,"percentile":0.39732,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-08-17T21:00:41Z","modified":"2026-10-28T11:17:11Z","fixes":[{"ecosystem":"Debian:14","package":"deskflow","fixed_in":["1.26.0+dfsg-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"deskflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.0+dfsg-7","1.23.0+dfsg-1","1.23.0+dfsg-2","1.24.0+dfsg-1","1.24.0+dfsg-2","1.25.0+dfsg-1","1.25.0+dfsg-2","1.25.0+dfsg-3","1.26.0+dfsg-1","1.26.0+dfsg-2","1.26.0+dfsg-3","1.26.0+dfsg-4","1.26.0+dfsg-5"]},{"source":"osv","ecosystem":"Debian:14","package":"deskflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0+dfsg-4"}]}],"versions":["1.22.0+dfsg-7","1.23.0+dfsg-1","1.23.0+dfsg-2","1.24.0+dfsg-1","1.24.0+dfsg-2","1.25.0+dfsg-1","1.25.0+dfsg-2","1.25.0+dfsg-3","1.26.0+dfsg-1","1.26.0+dfsg-2","1.26.0+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"deskflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0+dfsg-1","1.26.0+dfsg-3","1.26.0+dfsg-5ubuntu1","1.27.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"deskflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.0+dfsg-1","1.24.0+dfsg-2","1.25.0+dfsg-2","1.25.0+dfsg-3","1.26.0+dfsg-1"]}],"products":[{"vendor":"deskflow","product":"deskflow"}],"references":[{"url":"https://github.com/deskflow/deskflow/security/advisories/GHSA-jf7g-qghg-p54x","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65976.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65976","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-65976","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-65976","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65976","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-65976","title":"Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit","description":"Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.","status":"published","published":"2026-08-17T21:00:41.175Z","modified":"2026-08-18T17:47:20.73Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-60466","description":"Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.","status":"published","published":"2026-08-17T21:00:41Z","modified":"2026-08-18T17:47:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:46.405062Z"}],"nvd":[{"id":"CVE-2026-65976","description":"Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.","status":"published","published":"2026-08-17T21:16:47.027Z","modified":"2026-09-09T21:11:46.833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-65976","title":"Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit","description":"Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.","status":"published","published":"2026-08-17T21:00:41.175Z","modified":"2026-10-28T11:17:11.925277397Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-65976","description":"Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.","status":"published","published":"2026-08-17T21:16:47.027Z","modified":"2026-10-01T03:03:31.962883452Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"UBUNTU-CVE-2026-65976","description":"Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.","status":"published","published":"2026-08-17T21:16:00Z","modified":"2026-10-17T12:59:17.680727457Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"}]}}