AnyDesk
CVE-2026-15682
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local access and precise junction race-window timing required (AV:L/AC:H/PR:L); impact confined to availability via service file corruption, no confidentiality or integrity effect.
Primary rating from Vendor (zdi).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Send Support Information feature. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26645.
AnalysisAI
AnyDesk's 'Send Support Information' feature is exploitable by local low-privileged attackers via a Windows junction (directory reparse point) attack that forces the AnyDesk service to write files to an attacker-chosen path, producing a denial-of-service condition. Affected installations span all tracked AnyDesk versions per the NVD CPE wildcard, with no confirmed fixed version at time of analysis. No public exploit code has been identified and this vulnerability is not listed in CISA's KEV catalog; however, note that the source intelligence tags this as 'RCE,' which directly conflicts with the CVE description and CVSS vector (C:N/I:N/A:H) - the actual confirmed impact is availability-only denial-of-service.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access, 'Link Following') describes a class of vulnerability where a privileged process resolves a filesystem symbolic link, junction, or hardlink created by a lower-privileged attacker, causing the process to operate on an unintended target path. In Windows environments, directory junctions are a common vehicle: an attacker deletes or renames a directory that a privileged service is about to write into, substituting a junction pointing to a sensitive target. AnyDesk's 'Send Support Information' feature, which likely runs under or invokes a service with elevated privileges, writes diagnostic data to a predictable or attacker-influenceable path. By pre-positioning a junction at that path, the attacker redirects those writes to arbitrary filesystem locations, corrupting files or directory structures and inducing a denial-of-service condition. The CPE string cpe:2.3:a:anydesk:anydesk:*:*:*:*:*:*:*:* covers all versions without specifying a version ceiling, indicating no patched release has been communicated to NVD. The vulnerability was originally tracked internally by Trend Micro's Zero Day Initiative as ZDI-CAN-26645.
RemediationAI
No vendor-released patch has been confirmed from available data; the fixed version is not specified in the NVD CPE entry or the ZDI advisory reference (https://www.zerodayinitiative.com/advisories/ZDI-26-401/). Organizations should monitor AnyDesk's official security communications and the ZDI advisory page for patch release. As a compensating control, restrict interactive and programmatic local access to systems running AnyDesk to trusted, vetted users only, since exploitation requires low-privileged local code execution - this is the single most impactful mitigation given the AV:L requirement. If the 'Send Support Information' feature is not operationally required, disabling or restricting access to it eliminates the vulnerable code path entirely; consult AnyDesk administration documentation for feature-level controls, noting this may reduce diagnostic capabilities for support workflows. Deploying filesystem auditing (e.g., Windows Audit Object Access policies or Sysmon Event ID 11) on directories used by the AnyDesk service can detect unexpected junction creation or anomalous file writes as a detection-in-depth measure.
AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execut
AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYS
Anydesk versions up to 5.4.0 contains a vulnerability that allows attackers to potentially inject malicious executables
AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own
AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerabilit
AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Cha
AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate cli
AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability. Rated high severity (CVSS 7.8),
AnyDesk 7.0.8 allows remote Denial of Service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Denial-of-service in AnyDesk allows a local attacker with low-privileged code execution to crash or destabilize the appl
AnyDesk Link Following Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low
An issue was discovered in AnyDesk through 9.0.4. Rated high severity (CVSS 8.2), this vulnerability is remotely exploit
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today