External risk intelligence

AnyDesk Heap-Based Buffer Overflow Vulnerability allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-109390

AnyDesk is a remote desktop and remote access application designed to be reachable over the internet to facilitate connectivity between devices. Because it functions as a remote access service that is inherently intended for network-based communication, the vulnerable protocol handler is exposed to the internet by design in standard deployments.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical security vulnerability in AnyDesk, a remote desktop application. The flaw could permit unauthenticated attackers to execute code remotely on affected systems, potentially gaining unauthorized control without user approval. The main concern is confirming relevance and exposure to your environment.

Unapproved remote code execution is possible.
Critical flaw in widely used remote access software.
Confirm exposure and potential impact.

Attack Path

How an attacker could exploit the issue

Attackers can reach and trigger this vulnerability remotely without needing any special access or user interaction. The weakness lies within the session protocol's stream packet handler, where a failure to validate payload lengths can lead to code execution. This could allow an attacker to gain root-level command execution on a victim's Linux system without the victim needing to approve desktop control.

Attacker can exploit this over the network.
Vulnerability triggered by unvalidated payload length.
Risk of unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on a Linux system with root privileges. This could occur through the session protocol's stream packet handler when handling mode 5, if the payload length is not properly validated.

System command execution.
Network-based payload delivery.
Root-level system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability lies with the teams managing remote access solutions, likely including Infrastructure or Platform teams responsible for deploying and maintaining AnyDesk, and potentially the Security team for overseeing exposure and risk. The initial practical move is to identify all AnyDesk instances, determine their network reachability and criticality, and confirm the accountable owner for each deployment before planning remediation.

Identify AnyDesk instances and owners.
Verify network exposure and business impact.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AnyDesk and how is it used?

AnyDesk is a remote desktop software application that enables users to connect to and control computers from anywhere. It is commonly used by IT support teams, system administrators, and remote workers to access files, provide technical assistance, or manage servers across different physical locations over the internet.

What does CWE-130 mean for CVE-2026-109390?

CWE-130 refers to improper handling of length and size constraints. In the context of this CVE, it means the software fails to properly check the size of incoming data packets. This weakness, specifically a heap-based buffer overflow, allows an attacker to send a specially crafted packet that exceeds the memory space allocated for it, potentially leading to unauthorized command execution.

How is this heap-based buffer overflow triggered?

The vulnerability is triggered when the software's session protocol processes a specific type of network traffic, known as a mode 5 stream packet. It does not require any prior authentication or user interaction to activate. The condition is only met when the incoming payload length is left unvalidated, causing the memory overflow error that enables the attack.

Is my environment at risk from this vulnerability?

Halo Surface Signal indicates that because AnyDesk is designed to facilitate remote connectivity, its protocol handlers are typically exposed to the internet. This design choice means that standard deployments of the software are inherently reachable by network-based attackers. You should evaluate any internet-facing instances of the application as having a high likelihood of exposure.

What steps should I take if I use AnyDesk?

Begin by creating an inventory of all AnyDesk instances within your infrastructure to identify where the software is running. Once you have a complete list, verify the network reachability of these systems and determine their business criticality. Coordinate with the teams responsible for these deployments to prioritize patching and limit external access where possible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.