What happened
A critical vulnerability has been identified in versions of AnyDesk prior to 8.0.3, specifically affecting Linux deployments. The flaw stems from a heap-based buffer overflow in the stream packet handler for mode 5 within the session protocol. An attacker can exploit this vulnerability by sending a specially crafted payload with an unvalidated length value, leading to remote code execution on the affected system. Successful exploitation enables an unauthenticated attacker to execute arbitrary code with high privileges, such as root privileges on Linux systems.
The vulnerability is classified as CVE-2026-109390 and possesses a CVSS score of 9.8, reflecting its severity. While exploit conditions require network exposure and specific technical conditions, the attack does not require prior access or any user interaction. The attack surface is limited to exposed network services that accept connections without proper validation or access restrictions. Therefore, attackers can directly target vulnerable systems over a network with no additional steps involved, subject to network controls and safeguards in place.
Who is affected
The affected deployments include Linux-based installations of AnyDesk prior to version 8.0.3. Organisations running these versions are advised to review their environments for unsupported or unpatched instances of the software. The vulnerability’s impact could be significant due to the potential for unauthenticated remote code execution, especially in scenarios where such services are publicly accessible or inadequately network-segmented. All affected Linux deployments that have not yet been updated are at risk of exploitation from unauthenticated remote attackers.
Recommended actions
- Restrict network access to AnyDesk services by implementing network segmentation and access controls. Ensure that only trusted networks can connect to the affected services.
- Monitor network traffic for unusual connection attempts or payloads targeting the affected port range and protocol.
- Implement thorough security policies to limit exposure of network services that accept remote connections, especially those that may handle unvalidated payloads.
