Deskflow, a keyboard and mouse sharing application, contains an out-of-bounds read vulnerability that can be triggered by a remote, unauthenticated attacker. By sending a crafted kMsgDSetOptions (DSOP) message to the ServerProxy::setOptions function, the attacker can corrupt the modifier translation table. Subsequent calls to translateKey() or translateModifierMask() then index internal tables beyond their bounds, exposing four bytes of memory that can be chosen by the attacker or causing the client to crash. Additionally, sending an odd number of options can lead to a separate out-of-bounds read of the OptionsList data. The attack does not require prior authentication or privileged access; any Deskflow client communicating with a malicious server is vulnerable.

The vulnerability affects the Deskflow application provided by the vendor deskflow. All builds preceding continuous build 1.26.0.299 are impacted; the issue was resolved in that build and later versions.

The CVSS score of 8.2 classifies this flaw as high severity, and the EPSS score is currently unavailable. It is not listed in CISA’s KEV catalog. The bypass requires only the ability to send messages to a Deskflow client, which is typically an open network port. An attacker can remotely send a crafted message from an unauthenticated server, making exploitation straightforward for any client exposed to untrusted traffic. Successful exploitation can leak sensitive memory contents or produce a denial‑of‑service by crashing the client.