CyberRota Analysis
AI-GeneratedDeskflow versions 1.17.0 through 1.26.0.299 are vulnerable to a memory exhaustion attack due to improper handling of DCLP DataChunk messages, which can lead to excessive data being appended beyond the configured clipboard limits. This vulnerability could allow an attacker to disrupt service by exhausting the memory of the affected system. Organizations using Deskflow should prioritize upgrading to continuous build 1.26.0.300 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.