Deskflow's clipboard module allows a connected peer to repeatedly send data chunks that are appended beyond the declared size limit before validation, exhausting the receiver's memory and leading to service interruption. The flaw is an uncontrolled resource consumption vulnerability (CWE-400) that can be triggered by a malicious or compromised peer in an active Deskflow session. No explicit local privilege escalation is required, as any peer connected to the Deskflow instance can send the offending messages.

Deskflow keyboard and mouse sharing app, versions from 1.17.0 up to continuous build 1.26.0.300, are affected. The issue is resolved in continuous build 1.26.0.300 and later releases.

The CVSS score of 6.5 indicates moderate severity. The exploit probability is not quantified, and the vulnerability is not listed in the CISA KEV catalog. Since a peer can trigger the flaw over the Deskflow network channel, the attack vector is remote or network-based within the Deskflow session, and it results in denial of service rather than data compromise.