CVE-2026-63409 – Deskflow
“Malicious Deskflow servers can turn trusted connections into crashes and memory exposure.”
Deskflow fixes two remotely triggerable out-of-bounds read vulnerabilities affecting connected clients. CVE-2026-63409 allows a malicious server to crash a client using a malformed options message and is fixed in continuous build 1.26.0.296. CVE-2026-65832 can crash a client or disclose four bytes of process memory at an attacker-selected relative offset and is fixed in continuous build 1.26.0.299. CVE-2026-63409 has a CVSS score of 8.2, High severity. CVE-2026-65832 has a CVSS score of 8.2, High severity.
Public proof-of-concept material is available for both vulnerabilities. The fixes add protections around Deskflow option handling and array indexing to prevent malicious server-controlled values from causing out-of-bounds reads.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-125