Deskflow, a keyboard and mouse sharing application, contains a flaw where a malicious server can transmit an odd-length DSOP options vector. The client reads beyond the bounds of the array during option parsing, resulting in an out-of-bounds read and a crash. This vulnerability leads to a denial‑of‑service condition for the affected Deskflow client without granting the attacker any code execution or other privileges.

Vulnerable Deskflow client versions range from 1.17.0 up to continuous build 1.26.0.296. The failure occurs when the client connects to a Deskflow server that sends the malformed vector. All installations of Deskflow within that version range are impacted unless the application has been patched to the fixed continuous build n.1.26.0.296.

The CVSS score of 8.2 indicates high severity, but the EPSS score is not reported and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a malicious or compromised Deskflow server that deliberately sends the problematic options vector over an established connection to a client. An attacker would need to control or spoof a server that the client accepts, after which the client would crash and drop the session.