CVE-2026-109390

Published: Ott 12, 2026 Last Modified: Ott 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

130

Improper Handling of Length Parameter Inconsistency

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Memory Modify Memory Varies By Context
Applicable Platforms
Languages: C, C++, Not Language-Specific
View CWE Details
https://github.com/v12-security/pocs/tree/main/anydesk
https://github.com/v12-security/pocs/tree/main/anydesk
https://anydesk.com/en/changelog/linux
https://anydesk.com/en/changelog/linux
https://github.com/v12-security/pocs/tree/main/anydesk
https://github.com/v12-security/pocs/tree/main/anydesk