Key points
- CVE-2026-109390 is rated 9.8 Critical by the National Vulnerability Database.
- The vulnerability exists in the stream packet handler for mode 5 in the session protocol.
- AnyDesk versions before 8.0.3 are affected by this heap-based buffer overflow.
A severe security flaw in AnyDesk allows remote attackers to execute arbitrary code on Linux systems without any form of authentication. The National Vulnerability Database identifies this issue as CVE-2026-109390 and assigns it a CVSS score of 9.8, classifying it as critical. This vulnerability affects all versions of the remote desktop application released before version 8.0.3, leaving a wide range of users exposed to potential compromise.
In plain English
The bug is a heap-based buffer overflow located within the stream packet handler. Specifically, it occurs in mode 5 of the session protocol used by the software. The root cause is that the application fails to validate the payload length value in incoming data. Because this check is missing, an attacker can send malformed data that overflows the buffer, leading to the execution of unauthorized code on the victim's machine.
The background
According to the NVD record, this flaw allows unauthenticated remote attackers to achieve command execution as root on Linux systems. Crucially, the attacker does not need the victim to approve desktop control or interact with the application in any way. The vulnerability is demonstrated on Linux environments, where the lack of input validation in the stream handler provides a direct path for privilege escalation and system takeover without user consent.
What changes now
Security teams must recognize that any deployment of AnyDesk running a version older than 8.0.3 is vulnerable to this exploit. The severity rating of 9.8 indicates the flaw is critical. Organizations using this software for remote management or support should immediately audit their environments to identify instances of affected versions and prioritize remediation efforts to mitigate the risk of unauthenticated code execution.
Background: Input validation
Input validation cyber security requires checking every piece of data entering a system for type, length, and format. You must reject unexpected data immediately. This prevents attackers from injecting malicious code or causing system crashes. Trusting user input without strict rules allows breaches to occur.
Read the full guide: Input Validation Cyber Security: Stop Code Injection Before It Starts
What to do and how to stay safe
- Audit your network to identify all devices running AnyDesk versions prior to 8.0.3.
- Upgrade affected systems to version 8.0.3 or later once the vendor provides an update.
- Monitor network traffic for unusual connections to AnyDesk ports that lack proper authentication.
- Restrict inbound access to AnyDesk services using firewalls to limit exposure to untrusted networks.
Step-by-step guide: Detect Privilege Escalation Attacks: Log Signals and Blind Spots
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109390?
The National Vulnerability Database rates CVE-2026-109390 with a CVSS score of 9.8, which is classified as Critical.
