CVE-2026-109390

Published: Oct 12, 2026Modified: Oct 16, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: MITRE (Secondary)

Description

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

Related CWEs

CWE-130

Improper Handling of Length Parameter Inconsistency

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

References (3)

https://anydesk.com/en/changelog/linux

Source: cve@mitre.org

https://github.com/v12-security/pocs/tree/main/anydesk

Source: cve@mitre.org

https://github.com/v12-security/pocs/tree/main/anydesk

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.