Deskflow, a keyboard and mouse sharing application, contains a memory‑safety flaw in its clipboard deserialization routine. When a connected peer sends a malformed clipboard update, the outer size of the transfer is validated, but the internal structure of the serialized data is not. The unchecked internal lengths allow Deskflow to perform an out‑of‑bounds read during unmarshalling, potentially leaking arbitrary memory contents or causing a crash. This flaw does not directly enable code execution but can expose sensitive data or destabilize the application.

All installations of Deskflow running a version earlier than 1.26.0.138 are affected. The vulnerability exists in the core clipboard handling code and applies to every release of the application prior to the patched version.

The CVSS v3 score of 7.4 signifies a high severity vulnerability. The EPSS score of less than 1% indicates that the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The last known attack vector requires the attacker to be connected as a peer to the target Deskflow instance; the malicious payload is sent via the clipboard synchronization channel. Once connected, the attacker can send a crafted clipboard blob to trigger the vulnerability. Because the issue is remote within the peer connection, remediation should prioritize patching, while temporary mitigations can reduce exposure.