---
id: CVE-2026-109390
title: >-
  AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute
  arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for
  command execution as root without the victim approving desktop control
summary: >-
  AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute
  arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for
  command execution as root without the victim approving desktop control. In the
  stream p…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-130
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:17:07.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109390'
references:
  - url: 'https://anydesk.com/en/changelog/linux'
    label: cve@mitre.org
  - url: 'https://github.com/v12-security/pocs/tree/main/anydesk'
    label: cve@mitre.org
  - url: 'https://github.com/v12-security/pocs/tree/main/anydesk'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
ingestedAt: '2026-10-12T15:55:08.158Z'
---

## Overview

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.