{"id":"CVE-2026-109390","aliases":["EUVD-2026-97471","GHSA-p2jv-fpmf-jqjw"],"status":"published","title":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap...","description":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0161,"percentile":0.76279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-130"],"published":"2026-10-12T14:40:10Z","modified":"2026-10-16T17:25:57Z","products":[{"vendor":"anydesk","product":"anydesk"}],"references":[{"url":"https://github.com/v12-security/pocs/tree/main/anydesk","tags":["exploit"]},{"url":"https://anydesk.com/en/changelog/linux"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109390"},{"url":"https://github.com/advisories/GHSA-p2jv-fpmf-jqjw"}],"sources":{"cve":[{"id":"CVE-2026-109390","description":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","status":"published","published":"2026-10-12T14:40:10.223Z","modified":"2026-10-13T03:55:34.743Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:20:11.581788Z"}],"euvd":[{"id":"EUVD-2026-97471","description":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","status":"published","published":"2026-10-12T14:40:10Z","modified":"2026-10-13T03:55:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:21.690828Z"}],"ghsa":[{"id":"GHSA-p2jv-fpmf-jqjw","title":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap...","description":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","status":"published","published":"2026-10-12T15:32:22Z","modified":"2026-10-12T15:32:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T15:13:06.481163Z"}],"nvd":[{"id":"CVE-2026-109390","description":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","status":"published","published":"2026-10-12T15:17:07.98Z","modified":"2026-10-16T17:25:57.94Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:12:56.310333Z"}]}}