A connected peer can declare a small clipboard size in a DataStart message and then stream data far beyond the configured limit, for example 16 MiB against a 3 MiB limit.
During chunk assembly the incoming data was appended without enforcing either the declared size or the locally configured clipboardSize , so a peer could grow the target's memory use without bound. The assembly state was also held in statics rather than per connection.
This works over TLS, since the peer is an authenticated participant in the session rather than a network attacker.
This is the same flaw as Deskflow's GHSA-jf7g-qghg-p54x , in code shared between the two products, and carries the same CVE.
Fixed in Synergy 1.21.2. This advisory will be published once that release is out.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
