Is CVE-2026-41476 actively exploited?

No active exploitation of CVE-2026-41476 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41476 be exploited remotely?

Yes. CVE-2026-41476 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41476?

CVE-2026-41476 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-41476

HIGH

CVE-2026-41476

CWE-120Published: April 24, 2026· Updated: Apr 28, 2026

8.8

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.0th

Official Description

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.138, a remote memory-safety vulnerability in Deskflow's clipboard deserialization allows a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. The issue is in the implementation of src/lib/deskflow/IClipboard.cpp. This is reachable because ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp validates only the outer clipboard transfer size. It does not validate the internal structure of the serialized clipboard blob, so malformed inner lengths reach IClipboard::unmarshall() unchanged. This vulnerability is fixed in 1.26.0.138.

NVD Source

Technical Analysis

CVE-2026-41476 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.