CVE-2026-109390: Buffer Overflow
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
AnyDesk versions before 8.0.3 are affected. The issue was demonstrated on Linux, where exploitation resulted in command execution as root.
Does exploitation require credentials or user approval?
No. The reported attack is unauthenticated and does not require the victim to approve desktop control.
What capability does an attacker need to exploit this?
An attacker needs network access to reach the vulnerable AnyDesk service and send a crafted session-protocol stream packet using mode 5 with an invalid payload length.
What should teams do if they cannot patch immediately?
The provided data does not specify mitigations other than updating past the affected versions. Prioritize restricting network access to AnyDesk instances because exploitation is network-accessible and unauthenticated.