CVE-2026-109390

Summary

AnyDesk before 8.0.3 contains a heap-based buffer overflow vulnerability in its stream packet handler that allows unauthenticated remote attackers to execute arbitrary code as root without user approval. This represents a critical security flaw because it enables full system compromise from outside the network.

Exploitability

Exploitation is straightforward for unauthenticated attackers with no preconditions required, as the vulnerability occurs during initial connection handling and allows remote code execution with root privileges.

Blast radius

The impact could be widespread across all Linux systems running AnyDesk versions before 8.0.3, potentially affecting thousands of remote desktop sessions with full system compromise capabilities.

Detection

Monitor for unusual network connections to port 5800 (AnyDesk default) from external IPs, and watch for unexpected process creation patterns in the AnyDesk service logs that may indicate code execution attempts.

Prioritized remediation

Upgrade to AnyDesk 8.0.3 or later immediately to remediate this critical heap overflow vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.