Executive brief
Deskflow is an application that allows users to share a single keyboard and mouse across multiple computers. A flaw in how the software handles secure connections allows a remote attacker to freeze the application by sending malformed data. This results in significant input lag or a total loss of control over connected screens, effectively making the software unusable.
Technical details
A denial of service vulnerability exists in Deskflow's TLS handshake handling within the SecureSocket::secureAccept function. When a remote, unauthenticated attacker connects to the server's listening port (default 24800) and sends data that does not parse as a valid TLS ClientHello, the server enters a fatal-error branch that executes a blocking 1-second sleep (Arch::sleep(1)). Because this sleep occurs on the primary multiplexer worker thread responsible for all active connections, it stalls input delivery (mouse, keyboard, and clipboard) for all connected clients. A sustained attack of one malformed connection per second is sufficient to render the server unusable. The issue is resolved in version 1.26.0.167 by removing the blocking sleep call.
Affected products
- Deskflow Deskflow < 1.26.0.167
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fix committed and released in version 1.26.0.167