Vulnerabilities
Researchers publish exploit for AnyDesk Linux flaw that grants root access
A critical flaw in AnyDesk for Linux allowed attackers to gain root access before a connection was approved. Researchers published a working exploit, and AnyDesk quietly patched the issue in June.
Ross GrantUpdated 3 min read
The short version
A serious security flaw in AnyDesk for Linux let attackers take full control of a computer before the user approved a remote connection. Researchers published a tool that shows how the attack works. AnyDesk quietly fixed the problem in June, but many users may not know about the risk. If you use AnyDesk on Linux, update to the latest version as soon as possible.
What happened?
Security researchers published a working exploit for a flaw in AnyDesk for Linux that allows attackers to gain root access before a connection is approved. AnyDesk patched the issue in version 8.0.3 in June, but did not issue a security advisory or assign a CVE. The exploit was released publicly in October 2026.
What is the AnyDesk Linux vulnerability?
Security researchers have published a working exploit for a serious flaw in AnyDesk for Linux. The vulnerability lets an attacker gain root access to a Linux machine running AnyDesk, even before the user approves the remote connection. The exploit, called AnyPwn, was released on GitHub on 8 October 2026. The flaw was patched by AnyDesk in version 8.0.3 in June, but the company did not issue a security advisory or assign a CVE identifier. Instead, the changelog only mentioned a bug fix for crashes, leaving many users unaware of the security risk.The Hacker News (opens in a new tab), SC Media (opens in a new tab)
How does the exploit work?
The vulnerability is a heap buffer overflow in AnyDesk's session protocol. By sending a specially crafted packet before authentication, an attacker can overwrite memory and run code as root. The exploit works over direct TCP connections on port 7070. It is probabilistic, meaning it only works if the memory layout is favourable; otherwise, the service crashes. The published exploit targets AnyDesk Linux version 8.0.2, and would need adjustment for other builds. The researchers say the same code path is reachable via AnyDesk's relay servers, but they have not demonstrated a full exploit chain over relays.
The technical flaw is in how AnyDesk calculates the size of a memory allocation. The attacker declares a huge payload length, which wraps around due to 32-bit arithmetic, causing the software to allocate a tiny buffer but treat it as much larger. This lets the attacker overwrite adjacent memory and execute a command as root using a ROP (Return-Oriented Programming) chain.
Who is affected and what should they do?
AnyDesk Linux users running versions before 8.0.3 are at risk. The exploit only works on Linux, not on Windows or macOS. Administrators should update to at least version 8.0.3 as soon as possible. The latest release is 8.1.0. If updating is not possible, restricting access to TCP port 7070 can reduce exposure. It is not clear if the flaw can be reliably exploited over relay connections, but caution is advised.
How did AnyDesk respond?
The researchers announced the flaw on 22 June 2026. AnyDesk acknowledged it the next day and released version 8.0.3 with a fix. However, the company did not issue a formal security advisory or assign a CVE. The 8.0.2 version was removed from the download page after the exploit was published, but still appears in the changelog. AnyDesk stated that the vulnerability is limited to direct connections on Linux and does not affect Windows or macOS. There is no evidence that the flaw has been exploited in the wild.
Previous incidents and context
AnyDesk has faced security issues before. In early 2024, the company's production systems were breached, leading to certificate revocations and forced password resets. A separate heap buffer overflow (CVE-2025-27918) was fixed in April 2025, but that affected all platforms and was unrelated to this flaw.
What should organisations do next?
Organisations using AnyDesk for Linux should check their version and update immediately if they are running anything older than 8.0.3. They should also review firewall rules to restrict direct access to port 7070. Security teams should watch for signs of compromise and review logs for unusual activity. Since the flaw was not widely disclosed, some systems may still be vulnerable.
Uncertainties
There are no primary sources from AnyDesk or a government agency confirming all the technical details. It is unclear if the exploit can be reliably used over relay connections. No CVE has been assigned, and there is no formal advisory from AnyDesk.
Claimed vs confirmed
- Unconfirmed
The exploit works over relay connections as well as direct connections.
Researchers say the vulnerable code path is reachable via relays, but have not demonstrated a full exploit chain.
- Confirmed
AnyDesk Linux versions before 8.0.3 are vulnerable to pre-authentication root compromise.
Researchers published a working exploit for version 8.0.2. AnyDesk patched the issue in 8.0.3.
- Confirmed
AnyDesk did not assign a CVE or issue a security advisory for this flaw.
No CVE has been assigned and no formal advisory was published, according to The Hacker News.
The impact
- Money
- There is no public estimate of financial loss. If regulators determine that customer data was at risk, fines under GDPR could reach €20 million or 4% of global turnover.
- Reputation
- AnyDesk's reputation may be affected by the lack of transparency in disclosing the vulnerability and the quiet patching process. Previous security incidents may add to user concerns.
- Customers
- Linux users of AnyDesk are at risk of remote compromise. Users should update to version 8.0.3 or later and restrict access to port 7070 if immediate patching is not possible.
Why it matters
AnyDesk is a popular remote desktop tool. This flaw could let attackers take over Linux systems without user approval. Many organisations use AnyDesk for remote support and administration, so unpatched systems could be at risk of compromise.
How does it work?
The flaw is a heap buffer overflow in AnyDesk's session protocol. By sending a specially crafted packet before authentication, an attacker can overwrite memory and run code as root. The exploit works over direct TCP connections on port 7070 and is probabilistic, depending on memory layout.
Key points
- A critical flaw in AnyDesk for Linux allowed attackers to gain root access before approval.
- Researchers published a working exploit for the vulnerability.
- AnyDesk patched the issue in version 8.0.3 in June, but did not issue a security advisory.
- The exploit works over direct TCP connections on port 7070 and is probabilistic.
- Users should update AnyDesk for Linux to at least version 8.0.3 immediately.
Sources
The Hacker News
Reference
SC Media
Reference
