Security advisories - Synergy

Back Symless

Security advisories - Synergy

Symless • October 13, 2026

Share: View original

Clipboard receiver can accumulate data beyond the configured clipboard size limit

Single-byte LSYN language payload causes uncaught exception in client

Does not sufficiently verify the identity of connecting clients

Attacker can enter an active session state

Attacker can cause a segmentation fault in the server component

Server does not correctly close file descriptors for established TCP connections

Memory exhaustion in the server component

Privilege escalation through Daemon IPC server

Clipboard deserialization global-buffer-overflow

TLS multiplexer DoS on failed `SSL_accept`

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Flaw in Synergy Allows Clipboard Data Overflow A vulnerability, CVE-2026-65976, has been identified in Synergy, allowing connected peers to exceed clipboard size limits, potentially leading to memory exhaustion. The flaw arises from improper handling of clipboard data during assembly, where incoming data can bypass configured limits, resulting in unbounded memory use. This vulnerability affects all versions of Synergy prior to 1.21.2 and is particularly concerning as it can be exploited over TLS by authenticated peers. The issue is linked to similar vulnerabilities in Deskflow, indicating shared code between the two products. A patch has been released in Synergy version 1.21.2 to address this flaw. The advisory will be published following the release of the fix. 1 sources 73

Extracted Entities

Attack Types (2)

Denial of Service Privilege Escalation

CWE Weaknesses (1)

CWE-119 - Improper Restriction Of Operations Within Memory Buffer

MITRE ATT&CK (1)

T1068 - Exploitation for Privilege Escalation