AnyDesk for Linux: Heap buffer overflow enables unauthenticated code execution
Summary
AnyDesk for Linux versions from 8.0.0 before 8.0.3 contain a heap-based buffer overflow in the handling of mode-5 stream packets of the session protocol. The payload length is not validated, so a specially crafted packet can corrupt memory. An unauthenticated remote attacker can execute arbitrary commands, typically as root, without the victim approving desktop control. A public proof of concept exists, and exploitation is probabilistic.
Affected
- AnyDesk for Linux 8.0.0 to before 8.0.3 (CVE record)
- Tested build: AnyDesk Linux 8.0.2
- Versions below 8.0.0: unknown
- Windows and macOS: not affected according to a vendor statement
Fixed in
- AnyDesk for Linux 8.0.3 or later (latest release according to secondary reporting: 8.1.0)
- The vendor has not published a formal security advisory.
Workaround
- No vendor workaround is documented.
- Restrict inbound access to TCP/7070 at firewalls, VPN gateways and cloud security groups.
- Whether this also covers relay connections is unknown.
Exploitation
- Public proof of concept: yes, published on GitHub on 8 October 2026.
- CISA SSVC: exploitation status poc, automatable yes, technical impact total.
- Known exploited in the wild: no confirmed reports found.
- Relay connections: reachability is unconfirmed; the researchers report validation with a Frida trigger.
Our recommendation
- Update AnyDesk for Linux to version 8.0.3 or later on all hosts.
- Inventory all Linux hosts with AnyDesk, including those installed by individual users or support teams, and verify their versions.
- Block inbound TCP/7070 from untrusted networks until patched; check firewall and NAT rules for exposure.
- Review AnyDesk service logs, unexpected root processes and outbound connections on exposed systems.
- Remove old 8.0.2 installers that may still be on disk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AnyDesk Linux changelog anydesk.com
- V12 Security PoC repository (AnyDesk) github.com
- CCB Belgium advisory ccb.belgium.be
- The Hacker News: working exploit published thehackernews.com
- Cloud Security Alliance research note labs.cloudsecurityalliance.org
- Cryptika: AnyDesk Linux flaw www.cryptika.com
- GBHackers: AnyDesk vulnerability gbhackers.com
- CISA-ADP record (HOL Guard) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:13.
Original description (NVD)
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.