AnyDesk Heap Overflow Flaw Allows Unauthenticated Root Code Execution

AnyDesk versions prior to 8.0.3 contain a critical remote code execution vulnerability that allows unauthenticated attackers to gain root access on Linux systems. The National Vulnerability Database assigns this flaw CVE-2026-109390 and rates it with a maximum severity score of 9.8. This means the vulnerability is considered critical and poses an immediate risk to users who have not updated their software to the latest patched version.

The vulnerability exists within the stream packet handler for mode 5 in the AnyDesk session protocol. Specifically, the application fails to validate the payload length value received during communication. This oversight creates a heap-based buffer overflow condition, which attackers can exploit to execute arbitrary code. The lack of validation allows malicious data to overwrite memory structures, leading to unauthorized command execution on the affected machine.

Technical Context and Impact

According to the NVD record, the flaw is categorized under CWE-130, indicating an improper handling of buffer boundaries. The exploit does not require any form of authentication from the attacker, making it accessible to anyone with network access to the target. Furthermore, the attack bypasses the standard security model of remote desktop software, which typically requires explicit user approval for control actions. This means a victim does not need to accept a connection request for the attacker to execute commands.

The most severe impact occurs on Linux systems, where the arbitrary code execution happens with root privileges. This level of access allows an attacker to install malware, steal sensitive data, or pivot to other systems within the network. The ability to execute commands without the victim approving desktop control undermines the primary trust mechanism of remote assistance tools, leaving users vulnerable even when they are not actively engaging with a remote session.

Affected Versions and Scope

The vulnerability affects all versions of AnyDesk prior to 8.0.3. Users running older releases are exposed to this risk until they upgrade to the fixed version. The issue is specific to the session protocol implementation and has been demonstrated on Linux platforms. While the NVD record highlights Linux for command execution as root, the underlying buffer overflow mechanism may affect other operating systems supported by AnyDesk, though the specific privilege escalation context is noted for Linux environments.

Organizations using AnyDesk for remote support, IT management, or personal connectivity should verify their current version immediately. If the installed version is below 8.0.3, the system is vulnerable to unauthenticated remote attacks. The widespread use of AnyDesk in both enterprise and consumer sectors increases the potential attack surface, making prompt remediation essential for maintaining system integrity.

What should you do?

Security teams should prioritize identifying all instances of AnyDesk on their networks. Inventory management tools can help locate outdated versions that require updating. Until a patch is applied, consider restricting network access to AnyDesk ports to trusted sources only. Monitor for unusual outbound traffic or unexpected process executions on Linux hosts, which may indicate exploitation attempts.