Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The issue is in the implementation of src/lib/deskflow/IClipboard.cpp. This is reachable because ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp validates only the outer clipboard transfer size. It does not validate the internal structure of the serialized clipboard blob, so malformed inner lengths reach IClipboard::unmarshall() unchanged. This vulnerability is fixed in 1.26.0.138.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | Disclosure1 |
| 2026-04-25 | 2 | Active Exploitation1General1 |
Our CTI team identified a lot of activities targeting Deskflow (CVE-2026-41476) https://vuldb.com/vuln/359565/cti
Post summary
CTI reports indicate widespread activity targeting Deskflow CVE‑2026‑41476, suggesting the vulnerability is being actively exploited, though no PoC, patch, or technical details are disclosed.
CVE-2026-41476 Remote Memory-Safety Vulnerability in Deskflow Prior to 1... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41476 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet flags CVE‑2026‑41476, a memory‑safety flaw in Deskflow, and links to a vulnerability detail page, but presents no PoC, exploit code, patch, or evidence of active exploitation.
CVE-2026-41476 Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected pe… https://www.cve.org/CVERecord?id=CVE-2026-41476
Post summary
The post announces CVE‑2026‑41476, a remote memory‑safety flaw in Deskflow's clipboard deserialization affecting versions prior to 1.26.0.138.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | deskflow | deskflow | - | - | - |