Description
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AnyDesk | AnyDesk | 8.0.0 – < 8.0.3 | 8.0.3 |
Advisories 1
- WID-SEC-2026-3882 AnyDesk: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 12, 2026