Can Linux AnyDesk Users Below 8.0.3 Be Compromised by Critical CVE-2026-109390?
A critical flaw in AnyDesk versions prior to 8.0.3 enables remote attackers to run code as root on Linux without user approval, scoring 9.8 on the CVSS scale.
Key points
- The vulnerability is identified as CVE-2026-109390 and rated Critical with a CVSS score of 9.8.
- It affects AnyDesk versions older than 8.0.3 on Linux systems.
- Attackers can execute arbitrary code as root without the victim approving desktop control.
AnyDesk versions prior to 8.0.3 contain a critical security flaw that allows unauthenticated remote attackers to execute arbitrary code. The National Vulnerability Database lists this issue as CVE-2026-109390. The flaw receives a CVSS score of 9.8, placing it in the Critical severity range. This high score reflects the ease of exploitation and the severe impact on system integrity.
How does the vulnerability work?
The flaw exists in the stream packet handler for mode 5 within the session protocol. According to the NVD record, a payload length value is not validated in this component. This lack of validation leads to a heap-based buffer overflow. Attackers can exploit this overflow to execute arbitrary code remotely. The vulnerability is classified under CWE-130, which covers improper handling of length parameters.
What is the impact on Linux users?
On Linux systems, this vulnerability allows attackers to execute commands with root privileges. Crucially, this execution occurs without the victim approving desktop control. This means an attacker does not need to interact with the user or gain initial access through other means. The unauthenticated nature of the exploit makes it particularly dangerous for exposed systems.
Which versions are affected?
The NVD record specifies that AnyDesk versions before 8.0.3 are affected by this vulnerability. This includes all prior releases of the remote desktop software. Users running version 8.0.3 or later are not affected by this specific flaw. The record does not mention other operating systems, but the description explicitly demonstrates the issue on Linux.
What should administrators do now?
Administritors should immediately check their AnyDesk installations for version numbers. Any system running a version older than 8.0.3 is potentially vulnerable. Users should plan to upgrade to version 8.0.3 or newer as soon as possible. Until an update is applied, limiting network exposure to untrusted sources can reduce the risk of exploitation.
What to do and how to stay safe: AnyDesk
- Check the installed AnyDesk version on all Linux servers and workstations.
- Upgrade to AnyDesk 8.0.3 or a newer release to patch the flaw.
- Restrict network access to AnyDesk services to trusted IP ranges only.
- Monitor system logs for unusual activity or unauthorized command execution.
Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-109390?
It is a critical heap-based buffer overflow vulnerability in AnyDesk versions before 8.0.3 that allows unauthenticated remote code execution.
Does this affect Windows users?
The source material specifically demonstrates the vulnerability on Linux, allowing command execution as root without user approval.
Is user approval required for exploitation?
No, the vulnerability allows attackers to execute code without the victim approving desktop control, making it unauthenticated.
