// AI threat desk · 13 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighRCECVSS not assigned

AnyDesk Linux flaw could let attackers run root commands before approval

Security researchers said AnyPwn, published Oct 8, exploits a pre-authentication AnyDesk Linux flaw and can provide root access; The Hacker News said it targets Linux 8.0.2.

· 2 min read
AI-generated image of security analysts examining a Linux workstation and blurred system logs in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Security researchers said AnyPwn is a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux; The Hacker News said it targets version 8.0.2.
  • The Hacker News said AnyDesk patched the flaw in version 8.0.3 and that the published exploit works only over direct TCP connections on port 7070.
  • The Hacker News said the exploit, called AnyPwn, targets a heap buffer overflow in AnyDesk’s session protocol, and its code was released on GitHub on October 8.

Security researchers said they published a full working exploit on Oct 8 for a pre-authentication remote code execution flaw in AnyDesk Linux. The Hacker News said the exploit, called AnyPwn, targets AnyDesk Linux 8.0.2.

The V12 security team said successful exploitation yields root command execution before desktop-control approval. The Hacker News said the published exploit works only over direct TCP connections on port 7070; AnyDesk said the vulnerability is limited to direct connections on Linux, and that Windows and macOS are not affected.

AnyDesk is a remote desktop application distributed by AnyDesk Software GmbH that provides remote access to computers and other devices running the host application.

On this page

AnyPwn abuses a heap buffer overflow in AnyDesk’s session protocol

The V12 security team said AnyPwn is a pre-approval remote code execution vulnerability in AnyDesk Linux 8.0.2. It said Rick de Jager discovered the vulnerability with V12.

The session protocol’s mode-5 stream packet handler trusts a remote payload length before validating it. Adding the 16-byte object header to that length with 32-bit arithmetic can wrap to a tiny allocation while the object keeps its original large logical length.

The V12 security team said the supplied proof of concept exploits the resulting heap corruption through direct, local TCP/7070 transport and executes an arbitrary command. The Hacker News said the exploit is probabilistic because the heap layout must place a target object adjacent to the overflowed buffer; otherwise, the service crashes instead of executing the attacker’s command.

AnyDesk’s June fix followed a crash description

The Hacker News said AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the change as “fixed a bug that could lead to a crash,” with no CVE assigned and no security advisory.

The Hacker News said the published exploit works only over direct TCP connections on port 7070.

The Hacker News said no CVE had been assigned as of Oct 9 and AnyDesk had not issued a formal security advisory.

What to do now

  1. Update AnyDesk Linux to at least version 8.0.3.

FAQ

What happened to AnyDesk Linux?

Security researchers said they published AnyPwn, a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux. The Hacker News said the code was released on GitHub on Oct 8 and targets version 8.0.2.

What can the AnyDesk flaw do?

The V12 security team said the AnyDesk service normally runs as root on Linux, so successful exploitation yields root command execution before desktop-control approval.

Which AnyDesk versions are affected?

The Hacker News said the exploit targets AnyDesk Linux 8.0.2. It said earlier versions such as 8.0.1 may share the vulnerable code path, but exploitation of those versions has not been confirmed.

How do I fix the AnyDesk Linux flaw?

The Hacker News said administrators should update AnyDesk Linux to at least version 8.0.3. It said the latest release is 8.1.0.

Does the AnyDesk exploit work over relay servers?

The Hacker News said the published exploit works only over direct TCP connections on port 7070.

Are Windows and macOS affected by the AnyDesk flaw?

AnyDesk said the vulnerability is limited to direct connections on Linux and that Windows and macOS are not affected.

Sources

  1. pocs/anydesk at main · v12-security/pocs, GitHubPrimary
  2. Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access, The Hacker News
  3. AnyDesk, Wikipedia
How we checked this story
ClaimSourceStatus
security researchers said researchers published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before connection approval.security researchers, via The Hacker NewsAttributed
The Hacker News said anyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as a crash-related bug fix.The Hacker NewsAttributed
The Hacker News said the exploit, called AnyPwn, targets a heap buffer overflow in AnyDesk’s session protocol, and its code was released on GitHub on October 8.The Hacker NewsAttributed
The Hacker News said the published exploit works only over direct TCP connections on port 7070.The Hacker NewsAttributed
The Hacker News said the exploit is probabilistic because the heap layout must place a target object adjacent to the overflowed buffer; otherwise, the service crashes.The Hacker NewsAttributed
AnyDesk said the vulnerability is limited to direct connections on Linux, while Windows and macOS are not affected.AnyDesk, via The Hacker NewsAttributed
The Hacker News said the exploit targets AnyDesk Linux 8.0.2, while exploitation of earlier versions such as 8.0.1 has not been confirmed.The Hacker NewsAttributed
The Hacker News said no CVE had been assigned to the vulnerability as of October 9, and AnyDesk had not issued a formal security advisory.The Hacker NewsAttributed
The Hacker News said administrators who cannot update immediately can reduce exposure by restricting access to TCP port 7070.The Hacker NewsAttributed
The vulnerability was discovered with V12 by Rick de Jager of the V12 security team.V12 security team, via GitHubConfirmed
AnyPwn is a pre-approval remote code execution vulnerability in AnyDesk Linux 8.0.2.V12 security team, via GitHubConfirmed
The session protocol’s mode-5 handler trusts a remote payload length before validating it, allowing 32-bit arithmetic to produce a tiny allocation.V12 security team, via GitHubConfirmed
The supplied proof of concept exploits the heap corruption through direct local TCP/7070 transport and executes an arbitrary command.V12 security team, via GitHubConfirmed
The AnyDesk service normally runs as root on Linux, so successful exploitation yields root command execution before desktop-control approval.V12 security team, via GitHubConfirmed
AnyDesk is a remote desktop application distributed by AnyDesk Software GmbH that provides remote access to computers and other devices.WikipediaConfirmed

Could not verify

  • Whether the flaw has been exploited in the wild is not established
  • Whether the vulnerable code path is fully exploitable through relay connections is not established
  • Whether AnyDesk versions earlier than 8.0.2 are exploitable is not established
  • How many AnyDesk installations are affected is not established
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok