Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-109390: AnyDesk before 8.0.3 lets attackers run code as root
CVE-2026-109390 · published 4 days ago
Summary
AnyDesk versions earlier than 8.0.3 contain a flaw that lets someone on the network send specially crafted data and cause the program to run any commands they choose, even without the user’s permission. On Linux this can give the attacker full administrative control of the computer. Upgrade to the latest AnyDesk version or apply the vendor's security patch as soon as possible.
What to do
- Update anydesk anydesk to version 8.0.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| anydesk | anydesk | < 8.0.3 |
Original advisory text
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim ap...
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-130Improper Handling of Length Parameter Inconsistency
Timeline
Published12 Oct 2026
Updated16 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta