Heap-based Buffer Overflow in AnyDesk Before 8.0.3

Executive Summary

CVE-2026-109390 is a pre-authentication remote code execution (RCE) flaw in AnyDesk Linux version 8.0.2. It involves a heap-based buffer overflow in the session protocol's mode-5 stream packet handler. The vulnerability occurs because the payload length value is not validated, allowing attackers to manipulate it. This causes a 32-bit integer wrap, leading to heap corruption when copying attacker-controlled data into an undersized buffer. Successful exploitation grants root command execution on Linux systems.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-109390, check if AnyDesk Linux version 8.0.2 is installed. Use commands like 'anydesk --version' or inspect package managers (e.g., 'dpkg -l | grep anydesk' for Debian-based systems). Monitor network traffic for suspicious connections to TCP port 7070.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system with root privileges without any user interaction. This means they could take full control of your Linux machine running AnyDesk 8.0.2, install malware, steal data, or perform other malicious actions. The exploit works over direct network connections or AnyDesk relay connections.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using AnyDesk 8.0.2 may face compliance violations, legal penalties, and reputational damage if exploited. Immediate patching to AnyDesk 8.0.3 or later is critical to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade AnyDesk to version 8.0.3 or later immediately. If upgrading is not possible, disable AnyDesk service and block TCP port 7070 on firewalls. Avoid using AnyDesk relay connections until patched.

Useful 0 Not Useful 0