Remote support software sits awkwardly in most security models. It is installed by administrators, left running for convenience, and trusted to accept inbound connections from the internet. CVE-2026-109390 in AnyDesk for Linux is a memory-safety bug in that trust relationship, and its arithmetic is worth understanding because it explains why the fix was easy to miss.

What the record says

The CVE record states that AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code through a heap-based buffer overflow, demonstrated on Linux for command execution as root without the victim approving desktop control. The specific defect: in the stream packet handler for mode 5 of the session protocol, a payload length value is not validated.
The CVSS 3.1 score is 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No privileges, no user interaction, network reachable.

The arithmetic

Public analyses of the flaw, including the PoC repository credited in the CVE record and vendor-side write-ups, describe the same chain.
The mode-5 packet handler reads a declared payload length from the network. Before validating it, the code adds the object header size, 16 bytes or 0x10, to that value using 32-bit unsigned arithmetic. A declared length of 0xFFFFFFF0 plus 0x10 wraps to zero. The allocator is asked for a tiny buffer, while the object structure still records the enormous declared length.
The next write lands outside the allocated buffer and overwrites adjacent heap objects. From there the exploit path is conventional memory corruption work: arranging the heap so the overwritten object is one the attacker can influence, gaining control of execution, and pivoting through a ROP chain. The published exploit targets a specific build with specific offsets; public reporting notes that a failed heap layout crashes the service instead.

Why root changes the conversation

On Linux, the AnyDesk service process runs as root by default and listens on TCP 7070 for direct connections. A pre-authentication overflow in a root process means the attacker does not need to pass a session approval prompt, does not need an unattended-access password, and does not need the user to click anything.
That is a different risk profile from the usual remote-support concern, which is credential theft or social engineering. Here the software is the entry point, and the user's consent is irrelevant because the vulnerable code runs before consent is requested.
Public reporting also describes a disputed scope point. AnyDesk's position was that the flaw affects direct connections rather than its relay infrastructure. Researchers testing with dynamic instrumentation reported that the vulnerable code path can be reached through relay connections as well, while noting that a complete root-level chain over the relay had not been demonstrated. Both statements can be true: reachability of the code and weaponisation of the outcome are separate claims.

The disclosure sequence is part of the lesson

The vulnerability was reported in June 2026 and fixed in version 8.0.3. The changelog entry described a bug that could cause a crash. No CVE identifier was assigned at that point and no security advisory accompanied the release. The PoC was published in October 2026, and the identifier followed.
For defenders, this pattern produces a specific failure: patch notes are a security signal, and when a release note undersells a memory-safety fix, organisations that track only advisories do not treat the release as urgent. The window between the fix and the public exploit is the window in which a well-informed attacker can operate with a durable advantage.

Exposure

ZoomEye returns 461 matches for the application fingerprint app="AnyDesk" and 1,750 for title="AnyDesk" when queried for this article on 23 October 2026. These counts cover all platforms and versions, and they do not identify Linux hosts running a vulnerable build. They are a reminder that the product's management surface is on the public internet in large numbers; they are not a count of vulnerable Linux servers.
The relevant exposure is narrower and easier to establish internally: which Linux endpoints run AnyDesk as a service, and on which of those is TCP 7070 reachable from an untrusted network.

Remediation

  • Upgrade to 8.0.3 or later. Version 8.1.0 is the current line at the time of writing. Confirm the running binary, not the installer package, because upgrades that leave the old daemon in memory do not fix the exposure.

  • Block inbound TCP 7070 at the network boundary for endpoints that do not need direct connections. Where direct connections are required, restrict the source addresses to a management network.

  • Stop running the service as root where the platform permits it. AnyDesk's own guidance and distribution packaging decide what is possible; reducing the privilege of the listening process reduces the value of any future overflow.

  • Treat the endpoint as compromised if it ran an affected version with 7070 exposed and shows unexplained activity. A pre-authentication root overflow leaves no authentication record to review, so the evidence has to come from process behaviour and file changes.

Detection notes

Process supervision is the practical control. A remote-desktop daemon should not spawn shells, download tools or interpreters. On Linux, recording the process ancestry of anything launched under the AnyDesk service account, and alerting on the first such event, closes the gap that patch tracking leaves open.
The crash is also a signal. Because the exploit depends on heap layout, a failed attempt terminates the service. Repeated unexpected restarts of the AnyDesk daemon on an internet-exposed host deserve investigation, not just a restart script.

Closing

A single addition before a length check turned a validated field into an attacker-controlled allocation size. That is a small bug with a large consequence because of where it runs: a root service, reachable from the network, that exists to accept connections from strangers.

References

  • CVE.org record for CVE-2026-109390: https://www.cve.org/CVERecord?id=CVE-2026-109390

  • V12 Security proof-of-concept repository for AnyDesk: https://github.com/v12-security/pocs/tree/main/anydesk

  • AnyDesk Linux changelog: https://anydesk.com/en/changelog/linux

  • 51Testing summary of the disclosure and exploit status, October 2026: http://www.51testing.com/?action-viewnews-itemid-7811703

  • ZoomEye queries executed 23 October 2026: app="AnyDesk" 461, title="AnyDesk" 1,750