{"id":"CVE-2026-109390","published":"2026-10-12T15:17:07.980","lastModified":"2026-10-16T17:25:57.940","description":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-130"],"vendors":[],"products":[],"references":[{"url":"https://anydesk.com/en/changelog/linux","tags":[]},{"url":"https://github.com/v12-security/pocs/tree/main/anydesk","tags":[]},{"url":"https://github.com/v12-security/pocs/tree/main/anydesk","tags":[]}],"exploitRefs":[{"url":"https://github.com/v12-security/pocs/tree/main/anydesk","tags":[]},{"url":"https://github.com/v12-security/pocs/tree/main/anydesk","tags":[]}],"hasPoc":true,"ai":{"summary":"AnyDesk before 8.0.3 contains a heap-based buffer overflow vulnerability in its stream packet handler that allows unauthenticated remote attackers to execute arbitrary code as root without user approval. This represents a critical security flaw because it enables full system compromise from outside the network.","exploitability":"Exploitation is straightforward for unauthenticated attackers with no preconditions required, as the vulnerability occurs during initial connection handling and allows remote code execution with root privileges.","blast_radius":"The impact could be widespread across all Linux systems running AnyDesk versions before 8.0.3, potentially affecting thousands of remote desktop sessions with full system compromise capabilities.","remediation":"Upgrade to AnyDesk 8.0.3 or later immediately to remediate this critical heap overflow vulnerability.","detection":"Monitor for unusual network connections to port 5800 (AnyDesk default) from external IPs, and watch for unexpected process creation patterns in the AnyDesk service logs that may indicate code execution attempts.","tags":["rce","remote","desktop","linux"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:47:13.016Z"}}