A critical vulnerability allowing remote code execution in AnyDesk’s Linux version has been patched

A critical vulnerability in AnyDesk’s Linux version that allowed an unauthenticated remote attacker to execute code has been fixed. The issue, recorded as CVE-2026-109390, is rated critical with a 9.8 score on the CVSS 3.1 scale. The vulnerability affects Linux clients before version 8.0.3.

According to the record, the vulnerability stems from a lack of packet length validation in the part of the session protocol that handles mode 5 flow packets (CWE-130). An attacker can bypass length validation to trigger a stack-based buffer overflow, leading to remote code execution. In the reporting party’s scenario, commands can be run with root privileges on Linux, and the victim does not even need to approve a desktop control request.

Which versions are affected

The CVE record lists AnyDesk versions 8.0.0, 8.0.1, and 8.0.2 as affected; the vulnerability is fixed in 8.0.3 and later. The impact information is provided only for the Linux client, and there is no record for Windows or macOS.

Why it matters

Remote desktop tools are programs that give full access to a user’s machine and often run in the background. In this vulnerability, the attacker does not need to provide a password or session credentials; the target machine only needs to be able to reach the AnyDesk service. The fact that no privilege escalation is needed and the exploit can run without victim approval increases the risk. Because details of the issue and working exploit code have been shared in a public repository, the cost of delaying the update is high.

What to do

If you use AnyDesk on Linux, update to version 8.0.3 and check the installed version number. On a machine where you cannot update, shut down AnyDesk when you are not using it, do not leave the incoming connection port open to the internet, and restrict access to the local network or a VPN if possible. Cleaning up unused access passwords and permissions, and reviewing the access control list, also helps.

Source: NVD · CVE-2026-109390