CVE-2026-109390
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root w…
Published: 2026-10-12 · CVSS: 9.8 · CVSS 3.1
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7