CVE-2026-65976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65976
Aliases
  • GHSA-jf7g-qghg-p54x
Downstream
Published
2026-08-17T21:00:41Z
Modified
2026-09-11T08:26:23Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit
Details

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65976.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.17.0"
                },
                {
                    "fixed": "1.26.0.300"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/deskflow/deskflow

Affected ranges

Type
GIT
Repo
https://github.com/deskflow/deskflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8a535fd5dd48315eaaf6b93d5c7534d0592addef
Fixed
bcd3a658fc3b2ad735146fdc9efefa9462d195b7
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

v1.*
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.19.0
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65976.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "309222516417317995557150856551442640769",
                "259284590392546405849464662179972383922",
                "21602417009979778380772578760758343090"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-0e7ae46a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/server/Server.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "312621205259145371847929549531178252254",
            "length": 919
        },
        "id": "CVE-2026-65976-13028e08",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/deskflow/ClipboardChunk.cpp",
            "function": "ClipboardChunk::assemble"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "137543306254634996824895149600939967864",
                "320261419163749869371378822806814937645",
                "232293238942538669086987172989027703591",
                "117103469471376535013687252337841660160",
                "242464013245519486979433981123425610897"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-148ba907",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/unittests/deskflow/ClipboardChunksTests.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "322599549988231005477103938663873668181",
                "264383837369513468689213334119844786271",
                "327883670999351264990510398808019516636",
                "225827144427978933830481877973880676467",
                "133440892206322044266573201940523503440"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-163abe3d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/client/ServerProxy.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "85357614844454356167463360083567935499",
                "284256902270755103971626523805222673732",
                "316394269567305097114707898634144649587",
                "20578813131847722139191792097598112930"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-3a1d22b8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/client/Client.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "71698423569708829355585504722326985928",
                "121354490832883741992564003485328957261",
                "249550426806131504680994524588538920352",
                "192159304771518431422062161543022727536",
                "298310582723703955164086517056332967273",
                "259090771735566237449119885832859122509",
                "151949235110261961801368966666168117323",
                "47388242385588698442294846342629084365",
                "291357129520032517716813292255069542023",
                "202046308322878610442512346272175957392",
                "21763976873318958130782295522165303617",
                "185645355171630240032903934236821749954",
                "19131425217618920564771056912009980818",
                "189001015606078105482106692771082989664",
                "270929602377521631554348188282690450972",
                "269759651160838623444606849258509569687"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-5b578be9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/deskflow/ClipboardChunk.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "206062950578054744901606957465206400511",
            "length": 658
        },
        "id": "CVE-2026-65976-5c92dbe9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7",
        "target": {
            "file": "src/lib/client/Client.cpp",
            "function": "Client::Client"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "292027311333989711658026671307409610847",
                "12610068668222975586845509591596933205",
                "204483928921720777620954052539931744619",
                "58605904795594908426653109720228895902"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-5eaea2bd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/server/Server.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "293114351658881516907088851434294312235",
            "length": 876
        },
        "id": "CVE-2026-65976-784ed31b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7",
        "target": {
            "file": "src/lib/client/ServerProxy.cpp",
            "function": "ServerProxy::setClipboard"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "173148491884555565974723667273468193796",
            "length": 808
        },
        "id": "CVE-2026-65976-91744efc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/server/ClientProxy1_6.cpp",
            "function": "ClientProxy1_6::recvClipboard"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "283527224333543402246761345735467475912",
                "251518847620926114798700303834715614986",
                "149041290511520515469568979998683442367",
                "178654250393853904186583772917092184561"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-966669f0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/unittests/deskflow/ClipboardChunksTests.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "198150791001309321183426727236681970979",
                "113517984590788632027041101273420680162",
                "257126173507625965909546792058622222885",
                "195197802809845362663953667820123750782",
                "184288479832547112025430193753383372497",
                "152241653205890122467481449569579815948",
                "239196657709775446164325059037912725899",
                "267064868023794359827743686695367781192",
                "150481313150231804426276696781838222774",
                "329846964812720771014844328489412617338",
                "53430803038282534723893634948512366594",
                "117455203925714124071860252321161538757",
                "160221918091355427670154158755234174169",
                "330224002708068217875876910145134792411",
                "330888104060479173999038896385063900442",
                "129309617820200142804364753181329865728",
                "167532242976580046192216779291231592442",
                "256351425043483112666312482944683681594",
                "124174421970544515043994684672646320747",
                "130616564655658074198775553068456056068",
                "289464392609481356184122469729422927859",
                "214297309495002038431219282017589887676",
                "322848310275494928047413330256399639685",
                "130993966565145267046689148524796665239",
                "250562470118462000022189341793418411026",
                "131736674029673333612723516076902166204",
                "26880272723597189720413670093938912287",
                "252403036917891625780187870074208574699",
                "291653234606572287764925760825264370143",
                "90706363795776720004916093828471770951",
                "11042317829214431475270657347470303763",
                "125999858647247240471370847820948683899",
                "111050479653804833121546279804482495507",
                "19088079539656092639617985697209847328",
                "321944455496923582847252208539305490861"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-9a3109fa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/deskflow/ClipboardChunk.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "229827613282249999051590641687858635355",
                "300970762899255950083193539667370018493",
                "132829481211685643820969190425743424668",
                "96374714981864540725420859206803445432",
                "211437517742468649189402667791927188746",
                "377503388710503076297352137752187266",
                "103092812727280370996159133314056087097",
                "252942299017170229004478280012860304198",
                "185475100682247787680212183581240745449",
                "132637963091859964126199483585601494590"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-abf29c47",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7",
        "target": {
            "file": "src/lib/client/Client.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "14475653543293443696861484238487429904",
                "240716433595507065623618444059794060949",
                "310389362975549227778086648027769069495",
                "300539197543675519451871337137448628734",
                "14612086257712540680419468863408006351",
                "138633257179986197332823568823159012602",
                "231948459568141788276337479924718036682",
                "228109091908132824633121278775773459619",
                "148119390800845456275936431324297089277",
                "59511779166329300897255599939812356952",
                "131430291481499043571259457006145555052",
                "236586681880205470393591377571406701521",
                "332601757776056292898466296159904659881",
                "10395411363058868501332336022426589322",
                "98428341019255345896205613490594681873",
                "326420248615475563063028389958271007793",
                "95877205896072511079976455581741008066",
                "285495281735059451475445229163594396329",
                "51328244468001631680189876313095521322",
                "79021763321003449652989330411068064655"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-bcca8134",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/server/ClientProxy1_6.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "150784122598129318399558040558135244195",
                "150956171685609652397102590279187239414",
                "55257614930288513237871063291369608204",
                "4744488653889310415246875340248021270",
                "45051199990117417572562165659386731183",
                "132779292250244872847145828668901025511",
                "223518406536860511279266833131663620320",
                "17539424237316305185075665505440734252"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-bec5e807",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7",
        "target": {
            "file": "src/lib/client/Client.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "208191393600430679739325663897903233152",
                "228782988661648390637044140658400927661",
                "120119928925669181651984999307148620853"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-c5402bb2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/client/Client.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "24963519800784280076938001886857329820",
                "165067489875443543240498836282937896228",
                "281045612940149801597339338412872836714",
                "337670594013351155809946952300913273315"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-d1ecc169",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/server/ClientProxy1_6.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "288949074631217340063246244088606756885",
            "length": 554
        },
        "id": "CVE-2026-65976-d57c1b3f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/client/ServerProxy.cpp",
            "function": "ServerProxy::setClipboard"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "218003325252866358782942211913433263373",
                "258311840307058157841321737713762900271",
                "310389362975549227778086648027769069495",
                "187210259109994184636796011428996539010",
                "130591836120820459777595064683859326091",
                "78265228604846385596109669712727212876",
                "152632429999761897518363152221912562351",
                "243796721216205182344957211067698598520",
                "285757721933796017036195645509787825610",
                "238034930893578136597480805060369901711",
                "228455427939129121651736717972351272654",
                "136799310469304089271463548766249171014",
                "172509581612290690365514056991401481967",
                "59603473180177055084089242918777867504",
                "247395480066018394989697701063872387872",
                "258964711120655854152867690706121212216"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-e0a721fd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/8a535fd5dd48315eaaf6b93d5c7534d0592addef",
        "target": {
            "file": "src/lib/client/ServerProxy.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "186439239408078501849633613362322107206",
                "78770356830550399902509913553960210768",
                "303189107723166981072653950750735581240",
                "161586088548530229674447627709315703244"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-65976-f1d61dbf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7",
        "target": {
            "file": "src/lib/client/ServerProxy.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "138633797524911486231986552677130980083",
            "length": 97
        },
        "id": "CVE-2026-65976-f61bea52",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/deskflow/deskflow/commit/bcd3a658fc3b2ad735146fdc9efefa9462d195b7",
        "target": {
            "file": "src/lib/client/Client.cpp",
            "function": "Client::getMaximumClipboardSizeBytes"
        }
    }
]
vanir_signatures_modified 
"2026-09-11T08:26:23Z"