AnyDesk Linux Patch Fixes Remote Root Code Execution Flaw

AnyDesk released version 8.0.3 to address a heap buffer overflow in Linux builds that allowed attackers to gain root access before user approval.

Threat Times Exposure DeskOctober 13, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek desktop computer monitor displays a minimalist application interface on a clean desk. — AI-generated illustration: Threat Times

Key points

The vulnerability, named AnyPwn, affects AnyDesk Linux version 8.0.2.
Attackers can execute remote commands with root privileges via TCP port 7070.
Version 8.0.3 resolves the heap buffer overflow in the session protocol.

AnyDesk has released version 8.0.3 for Linux to patch a critical remote code execution vulnerability. The flaw, identified by security researchers as AnyPwn, allows attackers to gain root-level access to systems running the previous version, 8.0.2. This update addresses a heap buffer overflow that could be exploited before a user approves a desktop control session.

According to GBHackers, the vulnerability exists in AnyDesk’s session protocol, specifically within the mode-5 stream packet handler. The handler improperly trusts payload length data from remote sources without validating if it fits within the remaining packet. This miscalculation allows attackers to trigger integer overflows that result in insufficient memory allocations, leading to buffer overflows when data is copied.

Technical Details of the Vulnerability

The exploitation relies on a 32-bit arithmetic error in how AnyDesk calculates allocation sizes. The handler adds a 16-byte object header to the payload length. When an attacker specifies a length of 0xfffffff0, adding 0x10 results in 0x100000000, which truncates to zero in 32-bit arithmetic. This causes the system to allocate only zero to fifteen bytes of memory, while the logical length remains large.

Rick de Jager from the V12 security team demonstrated the exploit using a proof-of-concept targeting Linux x86_64 systems. The attack connects directly to TCP port 7070 on the AnyDesk service. Because the AnyDesk service typically runs with root privileges, successful exploitation grants the attacker root access to the entire system, bypassing standard user consent mechanisms.

Exploitation Mechanics and Risks

The attack process involves allocator grooming and return-oriented programming (ROP). An initial heap spray populates relevant allocation classes by size, while additional client connections create candidate victim objects. The overflow attempts to corrupt dispatch-related fields in neighboring objects, including control data used for redirecting execution flow.

To complete the attack, a separate spray populates memory with repeated ROP objects. Each object contains a return-instruction sled followed by a chain that calls the target binary’s system() entry with an attacker-chosen command. The researchers noted that success remains probabilistic, requiring specific memory conditions. Exploiting builds other than the tested version would require adjustments to offsets.

What should you do?

Administrators should verify the version of AnyDesk installed on all Linux endpoints. Systems running version 8.0.2 are vulnerable to remote root compromise. Updating to version 8.0.3 or later is necessary to resolve the heap buffer overflow. Organizations should also monitor network traffic on TCP port 7070 for unusual connection patterns that may indicate exploitation attempts.