CVSS 9.8: AnyDesk Pre-8.0.3 Stream Handler Flaw Grants Unauthenticated Root on Linux

The National Vulnerability Database published record CVE-2026-109390 to document a severe security flaw in the AnyDesk remote desktop application. This vulnerability affects all AnyDesk versions released before 8.0.3 and allows unauthenticated remote attackers to execute arbitrary code on targeted systems.

The flaw stems from a heap-based buffer overflow within the stream packet handler for mode 5 of the session protocol. According to the NVD record, the application fails to validate a payload length value, which enables an attacker to send malicious data that overflows the buffer. This technical weakness is categorized under CWE-130, indicating improper handling of buffer boundaries.

Technical Context

The specific mechanism involves the stream packet handler processing data for mode 5 in the session protocol. The NVD description states that a payload length value is not validated during this process. This lack of validation allows an attacker to craft a packet that triggers a heap-based buffer overflow. Consequently, the attacker can execute arbitrary code on the affected machine.

This vulnerability is particularly dangerous because it bypasses standard security controls that rely on user interaction. The NVD record explicitly notes that command execution as root can occur without the victim approving desktop control. This means an attacker does not need to trick a user into accepting a remote session request to gain high-level access.

Who Is Affected

AnyDesk installations running versions prior to 8.0.3 are vulnerable to this exploit. The NVD record identifies the affected product as AnyDesk AnyDesk before 8.0.3. While the description demonstrates the exploit on Linux systems, the record does not specify if other operating systems are immune or equally vulnerable.

Linux users face immediate risk because the flaw allows for command execution as root. Root access provides complete control over the system, allowing an attacker to install malware, steal data, or create backdoors. The absence of an authentication requirement means that any network accessible AnyDesk instance before version 8.0.3 is a potential target.

Defender's checklist

Security teams should immediately inventory their environments to identify any AnyDesk installations running versions older than 8.0.3. Network administrators should monitor for unusual outbound traffic from machines running this software, as this could indicate an active exploitation attempt. Since the flaw allows unauthenticated remote code execution, isolating vulnerable systems from untrusted networks is a prudent temporary measure.

What to do and how to stay safe: AnyDesk

• Verify the version of AnyDesk installed on all endpoints and compare it against the 8.0.3 threshold.
• Restrict network access to AnyDesk services by blocking inbound connections from untrusted IP ranges.
• Monitor system logs for unexpected process executions or privilege escalations on Linux hosts.
• Prepare to update to version 8.0.3 or later once the vendor officially releases the patched software.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109390?

The National Vulnerability Database rates CVE-2026-109390 as CVSS 9.8 Critical.

Does the attacker need to authenticate to exploit this flaw?

No, the NVD record states that unauthenticated remote attackers can execute arbitrary code.

Which versions of AnyDesk are vulnerable?

AnyDesk versions before 8.0.3 are affected by this heap-based buffer overflow vulnerability.