Unauthenticated Attackers Can Gain Root Access Through Flawed Session Processing
Security researchers have released a working exploit for AnyPwn, a serious memory-corruption flaw affecting AnyDesk 8.0.2 on Linux.
The issue allows an unauthenticated attacker to execute commands with root privileges before a remote desktop session is approved, potentially compromising systems running the vulnerable service.
Discovered by researcher Rick de Jager of the V12 security team, the weakness was patched in June 2026. However, public exploit code released on October 8 has renewed concerns about installations that remain unpatched.
Integer Overflow Creates Dangerous Memory Corruption
The weakness originates in AnyDesk's session protocol, specifically its mode-5 stream packet handler.
Manipulated Length Values Bypass Allocation Checks
The application calculates a memory allocation by adding a 16-byte header to a client-supplied payload length using 32-bit arithmetic.
A specially crafted value,0xFFFFFFF0, causes the calculation to wrap around to zero. The software subsequently handles the original large length, allowing attacker-controlled data to overwrite adjacent heap memory.
This heap buffer overflow can corrupt internal objects and potentially redirect program execution.
Public Exploit Demonstrates Privileged Command Execution
Researchers combined heap manipulation with return-oriented programming (ROP) to turn the memory-corruption condition into a working attack.
Direct Network Connections Are the Confirmed Attack Path
The published proof of concept targets AnyDesk Linux 8.0.2 on x86-64 systems, using direct TCP connections on port 7070.
Successful exploitation can execute an attacker-selected command as root because the affected service operates with elevated privileges.
However, exploitation is probabilistic. An unsuccessful attempt may crash the service instead of executing a command.
The released exploit also relies on build-specific memory offsets, meaning other versions or configurations would require additional research.
Relay-Based Exposure Remains Unconfirmed
The researchers demonstrated that the vulnerable protocol path can be reached through AnyDesk relay connections using Frida instrumentation.
No Complete Relay Exploit Has Been Demonstrated
This finding raises questions about whether the weakness could be exploited beyond direct connections.
However, the researchers have not demonstrated complete remote code execution through relay infrastructure.
AnyDesk previously stated that the issue was limited to direct Linux connections and that Windows and macOS were unaffected.
June Update Addresses the Security Weakness
AnyDesk acknowledged the research in June and released Linux version 8.0.3 with a fix.
Administrators Should Prioritize Immediate Updates
The original release notes described the change as a crash-related correction rather than explicitly identifying a security vulnerability.
As of October 9, no CVE identifier or dedicated vendor security advisory had been reported for AnyPwn.
Organizations should upgrade vulnerable Linux installations to version 8.0.3 or later, preferably the latest supported release.
Where immediate updating is impossible, restricting inbound access to TCP port 7070 can reduce exposure to the demonstrated direct-connection attack.
Administrators should also inventory remote-access installations and review network exposure.
The public exploit significantly increases the importance of patching, even though successful attacks against relay-connected systems have not been established.