CRITICAL 9.8 NVD
CVE-2026-109390
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command ex
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
References
- https://anydesk.com/en/changelog/linux
- https://github.com/v12-security/pocs/tree/main/anydesk
- https://github.com/v12-security/pocs/tree/main/anydesk
This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-10-12 via NVD.
Risk Timeline
CVE Disclosed2026-10-12 · -1 days ago
Remediation Resources
vulnfeed aggregates 10929 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.