A critical heap buffer overflow, pre-authentication, remote code execution flaw has been discovered in AnyDesk for Linux. Attackers could exploit this vulnerability to execute arbitrary commands with root privileges without requiring user approval.

Since a proof-of-concept exploit (called AnyPwn) is already publicly released, the flaw poses a critical risk to organizations with systems running vulnerable AnyDesk Linux installations.

In this blog, we break down what the vulnerability is about, the threat it poses, and what organizations should do.

About the AnyDesk Linux flaw

The vulnerability was originally discovered by a security researcher via GitLab’s HackerOne bug bounty program.

This vulnerability was initially discovered by V12’s security researcher, Rick de Jager, using V12’s AI-assisted code-review technology.  It arises because AnyDesk incorrectly calculates the memory needed to process incoming data. This calculation error can cause AnyDesk to allocate less memory than required to process incoming data. This causes the application to write data beyond the allocated buffer, allowing the attacker to execute malicious code.

• 22 June 2026 – V12 publicly disclosed vulnerability
• 23 June 2026 – 8.0.3 Fix released for Linux describing the flaw as a bug that could cause a crash without identifying it as a critical vulnerability.
• 8 October 2026 – Researchers release a public exploit named AnyPwn targeting a vulnerable Linux version.

The exploit doesn’t always work on every attempt. Its effectiveness depends on the memory layout and the targeted build. The public exploit uses direct TCP connections.

What can attackers do with this vulnerability?

By successfully exploiting the vulnerability, an attacker can:

• Gain root-level access to execute commands with the highest operating system-level privileges.
• Access and steal sensitive information like credentials, application data, and other information available on the compromised host.
• Establish persistence mechanisms like creating unauthorized accounts, modifying startup configurations, and installing malicious components to maintain access.
• Disable security controls, interfere with monitoring processes, or evade detection.
• Deploy additional malware like remote access implants, ransomware, and infostealers.
• Use a compromised Linux host to move laterally and target other systems.
• Disrupt operations by modifying/deleting data, interrupting services, and damaging system availability.

SharkStriker’s recommendations

• Identify Linux systems running AnyDesk, particularly version 8.0.2.
• Upgrade affected installations to AnyDesk 8.0.3 or later.
• Restrict inbound access to TCP port 7070 to trusted sources.
• Limit remote-access software to approved users and systems.