CVE-2026-109390CWE-130

CVE-2026-109390

Critical · published October 12, 2026

CVSS v3.1
9.8
EPSS
2%
Percentile
75.7
In the wild
Unconfirmed
What it is

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01610 · 75.7th percentile
Weakness
CWE-130 · Improper Handling of Length Parameter Inconsistency
Published
2026-10-12T19:17Z
References (3)
https://anydesk.com/en/changelog/linux · [email protected]https://github.com/v12-security/pocs/tree/main/anydesk · [email protected]https://github.com/v12-security/pocs/tree/main/anydesk · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 2%
    epss
  • 12 OCT 14:40Z
    AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command…
    cvelistv5
  • 12 OCT 14:40Z
    AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command…
    cvelistv5