AnyDesk CVE-2026-109390

Exploitation requires the attacker to reach the AnyDesk session protocol and send a packet to the stream packet handler for 'mode 5', where the payload length value is not validated, triggering a heap-based buffer overflow. No authentication is required (CVSS PR:N) and, notably, the victim does NOT need to approve desktop control - removing the primary interactive safeguard normally present in remote-desktop tooling. The root-level code execution outcome is specifically demonstrated on Linux; impact on other platforms is not stated. Limiting factors: the target must be running a vulnerable AnyDesk build (before 8.0.3) and the attacker must have network path to the AnyDesk service/port.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper finding. All signals point in the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the description confirms this is exercisable without the victim approving desktop control - eliminating the usual human-in-the-loop safeguard for remote-desktop software. The heap-based buffer overflow (CWE-130, improper length handling) yields full C:H/I:H/A:H impact, demonstrated as code execution as root on Linux. Crucially, a public POC exists (v12-security/pocs), which materially raises real-world risk by lowering the barrier to weaponization. Conflicting/missing signals to note explicitly: no EPSS score was provided, so statistical exploitation probability cannot be cited; and there is NO CISA KEV listing in the input, so despite the public exploit there is no evidence of active in-the-wild exploitation yet - POC availability and active exploitation are distinct, and this should be treated as 'exploitable and likely to be exploited' rather than 'confirmed exploited.' The CVSS network vector is consistent with the description's 'unauthenticated remote attackers.'

An attacker with network reach to a victim's AnyDesk endpoint sends a crafted session-protocol stream packet using mode 5 whose payload length field is unvalidated, triggering a heap-based buffer overflow in the packet handler. Because no authentication, user interaction, or desktop-control approval is required, this leads directly to arbitrary code execution - demonstrated as root on Linux. A public proof-of-concept exists, so the effort to adapt this into a working exploit is low.