Researchers from the V12 security team (Rick de Jager) published a full working exploit on GitHub on 8 October 2026 for a heap buffer overflow in the session protocol of AnyDesk for Linux. When handling mode-5 stream packets, AnyDesk adds a 16-byte header to the payload length declared by the remote side using 32-bit arithmetic with no overflow check; a declared length of 0xFFFFFFF0 wraps to a tiny allocation while the object keeps the huge length, so attacker data is written past the end of the buffer.

Because the AnyDesk service normally runs as root on Linux, the exploit gains root command execution before the desktop user approves the session.

The published exploit works over direct TCP connections to port 7070 and is tuned for build 8.0.2; it is probabilistic and may crash the service instead. The researchers say the same code path is reachable through AnyDesk relay servers (shown only with a minimal trigger), while AnyDesk said in June that the issue is limited to direct connections on Linux and that Windows and macOS are not affected.

The researchers reported the bug on 22 June; AnyDesk fixed it in Linux 8.0.3 the next day with a changelog line about a crash, assigned no CVE and issued no advisory (none as of 9 October).

The latest Linux release is 8.1.0. No exploitation in the wild has been reported.

Source: V12's research release on GitHub; wire: The Hacker News.

Correction (22 Oct 2026): the headline said the flaw had no CVE. CVE-2026-109390 was published on 12 October 2026, assigned and scored (CVSS 3.1 9.8) by MITRE as the CNA, covering AnyDesk for Linux 8.0.0 to before 8.0.3; Censys says AnyDesk still had not published its own security advisory as of 13 October. (source: Censys advisory, 13 Oct 2026; CVE record CVE-2026-109390)