CVE-2026-109390

EUVD-2026-97471
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
anydeskanydesk
8.0.0 ≤
𝑥
< 8.0.3
CNA
Common Weakness Enumeration
References
https://anydesk.com/en/changelog/linux
https://github.com/v12-security/pocs/tree/main/anydesk
https://github.com/v12-security/pocs/tree/main/anydesk