CVE-2026-41477
Deskflow: Local privilege escalation via unauthenticated IPC
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAccessOption enabled. The daemon processes privileged commands without authentication, allowing any local unprivileged user to execute arbitrary commands as SYSTEM. Affects both stable v1.20.0 + and Continuous v1.26.0.134 prerelease.
| CWE | CWE-306 CWE-862 |
| Vendor | deskflow |
| Product | deskflow |
| Published | Apr 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for deskflow deskflow
Be the first to know when new high vulnerabilities affecting deskflow deskflow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
deskflow / deskflow
<= 1.26.0.134 <= 1.20.0