CVE-2026-63409

CVE-2026-63409 is a bounds-checking failure in Deskflow's client-side handshake parsing. When a Deskflow server sends a DSOP (device options) vector with an unexpected length during the handshake phase, the client's ServerProxy::setOptions() attempts to read a value at a position that doesn't exist in the client's buffer. This is a read-beyond-vector condition that triggers an immediate client crash — no authentication or special privileges required. The vulnerability was introduced in build 1.17.0 and remained present through 1.26.0.296, a nine-version window that underscores a critical design flaw: the client's parsing logic implicitly trusts that any server it connects to will send well-formed protocol data. This trust assumption is dangerous because Deskflow's deployment model routinely involves users connecting to servers they don't control — conference room setups, shared workstations, corporate infrastructure. The moment a user connects to a malicious or compromised Deskflow server, that server can crash the client's session instantly. The CVSS 8.2 rating (High availability impact) likely understates the real-world exposure. The protocol design assumes symmetric trust between endpoints, but Deskflow's actual use case is fundamentally asymmetric — users must connect to servers outside their administrative control. A compromised conference room Deskflow server can sequentially crash every client that connects to it, disrupting collaborative workflows that depend on peripheral sharing. This argues for CVSS scope (S:) to be marked Changed, since the vulnerable component (server) extends its compromise directly into client availability across trust boundaries. The parsing logic in ServerProxy::setOptions() should be audited for similar off-by-one patterns elsewhere in the protocol handler. If the fix was narrowly scoped to just this function, adjacent message types in the PacketStreamFilter call chain likely harbor comparable missing-length-validation vulnerabilities. The nine-version persistence window suggests this was not caught by systematic protocol fuzzing during development — organizations using Deskflow should prioritize updating clients to 1.26.0.296 or later, and consider whether mutual authentication or server identity verification can be layered atop the current protocol to mitigate future trust-assumption vulnerabilities.

Reviewed through automated stages and approved by a human before publication.