Description

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-12T15:17:07.980Z",
  "pubdate": "2026-10-12T15:17:07.980Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists in AnyDesk versions prior to 8.0.3, stemming from improper validation of payload length values within the session protocol's stream packet handler.\nThis vulnerability allows unauthenticated remote attackers to execute arbitrary code on the target system. On Linux-based environments, this can result in the execution of commands with root privileges without requiring user interaction or approval for remote desktop control.\nThe flaw represents a significant security risk, as it bypasses standard authorization mechanisms, enabling full system compromise. The absence of authentication requirements makes this vulnerability highly exploitable by remote threat actors targeting exposed AnyDesk services.\nOrganizations using affected AnyDesk versions are at risk of unauthorized access, arbitrary code execution, and complete loss of system integrity. Remediation involves immediate upgrade to version 8.0.3 or later to patch the underlying logic error in packet processing.",
  "technicalDetails": "The vulnerability resides within the session protocol implementation of AnyDesk, specifically targeting the stream packet handler associated with 'mode 5'. The root cause is a lack of rigorous bounds checking on the payload length field provided in incoming network packets.\nWhen the AnyDesk client processes a mode 5 packet, it extracts a length value from the packet header without verifying if this value corresponds to the actual allocated size of the destination buffer on the heap. An attacker can craft a malicious packet containing an inflated length value, which, when processed by the application, triggers a heap-based buffer overflow.\nThe exploitation flow initiates when a remote attacker sends a specifically crafted packet to the AnyDesk service. Because the vulnerability exists within the initial packet handling phase of the session protocol, the attacker does not need to be authenticated or authorized by the victim. Upon receipt of the packet, the stream packet handler performs a memory copy operation using the attacker-supplied, unvalidated length value.\nThis overwrite allows the attacker to corrupt adjacent heap memory, enabling the corruption of function pointers, object vtables, or other critical structures. By carefully crafting the heap layout, an attacker can redirect the execution flow to arbitrary code, such as shellcode or a ROP chain, injected into the heap.\nOn Linux systems, the AnyDesk process often runs with high privileges. Consequently, the successful exploitation of this heap overflow enables the execution of arbitrary commands with root-level privileges. This effectively grants the attacker total control over the host machine, bypassing the intended security model where remote desktop control requires explicit user consent.\nThis vulnerability is classified as a remote code execution (RCE) flaw due to the ability to trigger the overflow over the network without prerequisite interactions. The lack of validation occurs at the protocol parsing layer, meaning any network-reachable instance of AnyDesk running a vulnerable version is susceptible to exploitation."
}