CVE-2026-109390 in AnyDesk
Summary
by MITRE • 10/12/2026
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in AnyDesk versions prior to 8.0.3 represents a critical security flaw rooted in improper input validation within the application's network communication layer. Specifically, this issue manifests as a heap-based buffer overflow located within the stream packet handler for mode five of the session protocol. The core technical deficiency lies in the failure to validate the payload length value provided by remote peers during the establishment or maintenance of a desktop sharing session. In standard secure software design, any external input that dictates memory allocation sizes must be rigorously checked against expected bounds to prevent buffer overflows. By neglecting this validation step, the application allocates insufficient heap memory for processing incoming data packets, leading to an overflow condition when larger payloads are processed than anticipated by the allocated buffer size.
This technical flaw has severe operational implications because it allows unauthenticated remote attackers to execute arbitrary code on the victim's system without requiring any user interaction or approval of desktop control requests. Typically, AnyDesk requires explicit consent from a local user before granting access, which serves as a primary defense against unauthorized intrusion. However, due to this vulnerability, an attacker can bypass these interactive security controls entirely by crafting malicious network packets that exploit the buffer overflow during the protocol handshake or data transmission phase. The exploitation of this heap-based overflow enables the injection and execution of shellcode with elevated privileges, potentially resulting in full system compromise where the attacker gains root-level access on Linux systems or equivalent administrative rights on other platforms.
From a classification perspective, this vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write to Heap. These categories highlight the fundamental error in memory management where input data exceeds the allocated buffer capacity, leading to corruption of adjacent heap metadata or arbitrary code execution through control flow hijacking techniques like return-oriented programming (ROP). Furthermore, within the context of the MITRE ATT&CK framework, this vulnerability facilitates initial access and privilege escalation tactics. Attackers can leverage this flaw for remote code execution without authentication, which maps to techniques involving exploitation of software vulnerabilities during the initial compromise phase, allowing them to establish a foothold on the target network with minimal detection risk since no user consent is triggered.
Mitigation strategies must prioritize immediate patching as the primary defense mechanism. Organizations relying on AnyDesk should upgrade to version 8.0.3 or later where this input validation logic has been corrected to properly check payload lengths before processing. In environments where upgrading is not immediately feasible, network-level controls such as firewalls and intrusion detection systems can be configured to monitor for anomalous traffic patterns associated with heap overflow attempts, although these are less effective than direct remediation of the code flaw. Additionally, implementing strict application whitelisting policies can help prevent unauthorized execution of any modified or malicious binaries that might result from successful exploitation of this vulnerability. Regular security audits and penetration testing focused on network protocol handlers are recommended to identify similar input validation gaps in other components of the software stack.