critical9.8
CVE-2026-109390
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command e…
Impact
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| AnyDesk | AnyDesk | before 8.0.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.