Deskflow is a keyboard and mouse sharing app. (CVE-2026-63409)

Deskflow, a keyboard and mouse sharing application, has a vulnerability identified as CVE-2026-63409 affecting versions from 1.17.0 until continuous build 1.26.0.296. A malicious Deskflow server can send an odd-length DSOP vector to the ServerProxy::setOptions() function, which expects key-value pairs. Because the final option key lacks a corresponding value, the client reads beyond the vector boundary during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain, resulting in a crash of the connected client. This denial-of-service condition is resolved in continuous build 1.26.0.296.

A remote attacker controlling a Deskflow server can cause connected clients to crash by sending malformed handshake data. This results in a denial-of-service condition on the client side. There is no indication of confidentiality or integrity impact. The CVSS 3.1 score is 8.2 (high severity) reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability.

Upgrade Deskflow clients to continuous build 1.26.0.296 or later where the vulnerability is fixed. No other mitigation is indicated by the vendor advisory.