External risk intelligence

AnyDesk Integer Overflow and Heap Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-27918

AnyDesk is a remote desktop application designed for network-based connections between clients. Because it facilitates remote access and discovery, the software is commonly deployed to listen for and process incoming network packets from external sources, making it a likely target for exposure in real-world environments where users establish connections across networks.

Integer Overflow

Anydesk

before 9.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An integer overflow vulnerability in AnyDesk's Discovery feature and connection processes could allow an attacker to remotely execute code. This issue affects AnyDesk for Windows, macOS, Linux, iOS, and Android.

Software flaw allows remote code execution.
Critical vulnerability impacts common remote access tool.
Confirm relevance and exposure for AnyDesk.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted UDP packets to a vulnerable AnyDesk client. This can occur during the discovery process or when establishing a connection between clients. Successful exploitation allows an attacker to cause an integer overflow, leading to a heap-based buffer overflow, which can result in a denial-of-service condition or potentially more severe impacts like code execution.

Network access required.
UDP packet triggers overflow.
Potential for denial of service.

Live Threat

Current exploitation, exposure, and threat context

The described vulnerability involves an integer overflow leading to a heap-based buffer overflow when processing UDP packets related to the Identity user image in the Discovery feature, or during client-to-client connections. This could potentially impact the integrity and availability of the AnyDesk application.

System integrity and availability.
Via network UDP packet processing.
Disruption of remote access service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying and addressing this critical vulnerability requires collaboration between the AnyDesk application owners, platform teams managing remote access infrastructure, and security operations for exposure assessment. The initial practical step is to inventory all AnyDesk deployments, confirm their network exposure, and prioritize remediation based on business criticality and potential impact.

Application owners must prioritize.
Verify network exposure and business criticality.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AnyDesk and how is it used?

AnyDesk is a widely used remote desktop application that allows users to connect to and control computers from different locations. It is designed to facilitate seamless remote access, technical support, and file transfer across various operating systems, including Windows, macOS, Linux, iOS, and Android, by managing network-based connections between client devices.

What does CVE-2025-27918 mean by integer and buffer overflow?

This vulnerability involves an integer overflow, where a calculation exceeds the storage capacity of a variable, leading to a heap-based buffer overflow. In plain terms, the software fails to correctly handle incoming data, causing it to overwrite adjacent memory space. This memory corruption can disrupt the application or potentially allow an attacker to run unauthorized code on the system.

How is this vulnerability triggered?

The flaw is triggered when an AnyDesk client processes a specifically crafted UDP packet containing Identity user image data. This happens during the application's Discovery feature or while a connection between two clients is being established. Simply having the software installed without active communication or incoming connection attempts does not trigger this specific memory error.

Is my system at risk from this CVE?

Halo Surface Signal indicates that because AnyDesk is built to listen for and process incoming network packets for remote discovery, it is often exposed to external network traffic. If your AnyDesk instances are reachable over a network, they are at higher risk. Systems that are isolated from external networks or restricted by strict firewall rules face a different threat profile.

How should I respond to this AnyDesk issue?

Your first step is to create an inventory of all AnyDesk installations across your environment to identify which versions are in use. Once identified, check your current software version against the vendor's updated releases. Focus on prioritizing updates for instances that are most accessible over the network to minimize your potential attack surface while planning for a full deployment of the latest versions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.