CVE-2026-109390
Quick assessment
Affected
AnyDesk AnyDesk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 AnyDesk 8.0.3 之前的版本中，未经验证身份的远程攻击者可通过基于堆的缓冲区溢出漏洞执行任意代码。该漏洞已在 Linux 平台上被证实：攻击者可在未获得受害者批准的情况下，以 root 权限执行命令。问题出现在会话协议中模式 5 的流包处理程序里，其中有效载荷长度值未进行有效性验证。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109390
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
长度参数不一致性处理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109390
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109390
请登录查看更多情报信息。
Other References for CVE-2026-109390 (2)
IV. Related Vulnerabilities
Same product: AnyDesk
-
CVE-2026-15681
AnyDesk Screen Recording Link Following Denial-of-Service Vu -
CVE-2026-15682
AnyDesk Support Information Link Following Denial-of-Service -
CVE-2016-20094
AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege -
CVE-2019-25261
AnyDesk 5.4.0 - Unquoted Service Path -
CVE-2025-34499
AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vul
Same vendor: AnyDesk
-
CVE-2026-15681
AnyDesk Screen Recording Link Following Denial-of-Service Vu -
CVE-2026-15682
AnyDesk Support Information Link Following Denial-of-Service -
CVE-2016-20094
AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege -
CVE-2019-25261
AnyDesk 5.4.0 - Unquoted Service Path -
CVE-2025-34499
AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vul
Same weakness: CWE-130
V. Comments for CVE-2026-109390
No comments yet