AnyDesk Linux pre-auth RCE exploit gives root access. Security researchers have released a working exploit for a critical pre-authentication remote code execution flaw in AnyDesk for Linux that allows an attacker to gain root access on a target system without any user interaction or session approval.[[1]] [[2]] [[8]] The exploit, dubbed AnyPwn, targets a bug that AnyDesk quietly fixed in version 8.0.3 in June, describing it only as "fixed a bug that could lead to a crash" in the changelog, with no CVE identifier or formal security advisory attached.[[1]] [[2]] The vulnerability is a heap-based buffer overflow in AnyDesk's session protocol implementation, reachable before authentication and exploitable over direct TCP connections on port 7070.[[1]] [[2]] [[8]] According to the researchers, a carefully crafted network packet can corrupt adjacent heap objects and trigger a return-oriented programming (ROP) chain that executes arbitrary commands with root privileges on the Linux host.[[1]] [[2]] The exploit is probabilistic: if the heap layout does not place a suitable object next to the overflowed buffer, the AnyDesk service will simply crash instead of running the attacker's payload, but repeated attempts can eventually succeed.[[1]] [[2]] The issue first came to light in late June when vulnerability researchers at V12, via the Ransomware Task Force ISAC, disclosed that they had identified a critical heap buffer overflow in AnyDesk enabling zero-click, unauthenticated remote code execution on Linux.[[8]] In that early statement, AnyDesk said the impact was limited to direct connections on Linux that do not traverse its relay infrastructure and stressed that Windows and macOS clients were not affected, adding that it had found no evidence of exploitation against its infrastructure or customer environments at the time.[[8]] A patch was promised within 48 hours and ultimately shipped as part of AnyDesk 8.0.3, but the fix was not framed as a security update and no CVE has been registered for the flaw as of October 9.[[1]] [[2]] Protect Devices AnyDesk has a prior history of serious remote code execution bugs in its Linux client, including CVE-2020-13160, a format-string vulnerability affecting AnyDesk for Linux and FreeBSD before version 5.5.3 that also allowed RCE and carries a CVSS v3.1 score of 9.8 (Critical).[[11]] The newly exploited pre-auth heap overflow appears to be a distinct issue in newer code and is not covered by that older CVE, underscoring gaps in formal vulnerability tracking for the current flaw.[[1]] [[11]] Public CVE aggregation services and vendor-specific lists still show no entry for a Linux pre-auth RCE in AnyDesk 8.x, reinforcing that this bug remains unofficially documented despite its severity.[[5]] [[6]] The AnyPwn exploit code was published on GitHub on October 8, significantly lowering the barrier for threat actors to weaponize the flaw against unpatched Linux systems running AnyDesk.[[1]] [[2]] Remote desktop tools like AnyDesk are frequently abused in ransomware and intrusion campaigns, where attackers install them to maintain persistent, interactive access to compromised hosts.[[13]] With a working, pre-auth exploit now available, adversaries no longer need valid credentials or social engineering to gain control over exposed AnyDesk Linux instances, making direct TCP access on port 7070 a high-value target for scanning and opportunistic attacks.[[1]] [[2]] [[8]] Defenders should treat this vulnerability as a critical remote code execution risk and prioritize upgrading AnyDesk for Linux to at least version 8.0.3, with the latest 8.1.0 release recommended where possible.[[1]] [[2]] Administrators unable to patch immediately can reduce exposure by restricting or firewalling direct TCP access to port 7070, ensuring AnyDesk traffic is forced through the vendor's relays, which are not affected by the exploit according to the initial impact assessment.[[1]] [[2]] [[8]] Security teams should also monitor for unusual inbound connections targeting AnyDesk services and consider the presence of outdated Linux clients as a potential indicator of elevated compromise risk, particularly in environments where remote desktop tools are widely deployed.[[1]] [[13]]

AnyDesk Linux flaw lets remote attackers execute code as root without authentication. A working proof-of-concept for a serious AnyDesk Linux vulnerability that can let remote attackers run commands as root without authentication or user approval. The issue, named AnyPwn, affects AnyDesk Linux 8.0.2 and was fixed in version 8.0.3. Organizations using AnyDesk for Linux should update immediately and check whether TCP port 7070 is exposed to untrusted networks. The flaw was discovered by Rick de Jager of the V12 security team using V12, an AI-powered security review platform. V12 first disclosed the issue publicly in June and described it as a pre-authentication, zero-click remote code execution flaw caused by a heap buffer overflow. AnyDesk acknowledged the report the following day and released the 8.0.3 update in June. The public exploit code was later released on October 8, bringing fresh attention to systems that may still run the older Linux build. AnyDesk Linux flaw. According to technical documentation published by V12 Security, the issue exists in AnyDesk's session protocol, which handles data exchanged while a remote client connects to the service. In the affected version, the mode-5 stream packet handler accepts a remote payload length before safely validating it. The software then adds a 16-byte object header to that value using 32-bit arithmetic. A specially formed length can cause that calculation to wrap around, leading the application to reserve a very small memory area while still treating it as a much larger object. That mismatch creates an out-of-bounds write condition. Put simply, the attacker can send a small network packet that tells AnyDesk to expect a huge amount of data. The vulnerable service then writes attacker-controlled data beyond the small allocated memory area. This can corrupt nearby objects in memory and, under the right conditions, redirect program execution. The researchers showed that the issue could be used to execute an arbitrary command through the AnyDesk service. The security impact is severe because the AnyDesk service normally runs with root privileges on Linux. Root is the highest privilege level on the operating system, allowing control over files, processes, user accounts, and security settings. An attacker who successfully triggers the flaw could gain a strong foothold on the affected host before a victim accepts a desktop-sharing request. That makes this issue very different from many remote-support risks that require stolen credentials, user approval, or unattended-access passwords. The released exploit targets AnyDesk Linux 8.0.2 running in service mode on x86_64 systems. It uses a direct connection to TCP port 7070 and depends on a specific memory layout, meaning exploitation is not guaranteed every time. When the memory layout is unsuitable, the service may crash instead of running the attacker's command. The published exploit also relies on offsets for the exact vulnerable build, so it should not be treated as proof that every AnyDesk Linux version can be exploited in the same way. There is an important point about network exposure. AnyDesk initially said the issue was limited to direct Linux connections and did not affect Windows or macOS. The V12 researchers said they also reached the vulnerable code path through AnyDesk relay connections using a Frida-based test. However, they did not demonstrate the full root-code-execution chain through relays. As a result, direct exposure of TCP/7070 is the confirmed risk, while full relay-based exploitation remains unresolved. Administrators should first identify Linux machines running AnyDesk 8.0.2 or older builds and upgrade them to version 8.0.3 or later. Where patching cannot happen at once, teams should restrict inbound access to TCP/7070 at firewalls, VPN gateways, and cloud security groups. They should also review AnyDesk service logs, unexpected root-level processes, and outbound connections from systems that exposed the port. AnyDesk's Linux changelog records the vendor's fixes, although the entry described this issue only as a bug that could lead to a crash rather than a security vulnerability. The disclosure also adds to the security history of remote-access software, which is often installed on high-value servers and widely trusted by IT teams. Cyber Security News previously reported on a separate AnyDesk flaw with a public proof-of-concept affecting Windows, while recent incident reporting has shown how legitimate remote-management tools such as AnyDesk can be used after compromise for continued access. Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC The post AnyDesk Linux flaw lets remote attackers execute code as root without authentication appeared first on cyber Security News. Related cyber Security News posts. A critical vulnerability in AnyDesk, a popular remote desktop application, has been discovered that could allow attackers to expose users' IP addresses. The flaw, identified as CVE-2024-52940, affects AnyDesk versions 8.1.0 and earlier on Windows systems. Security researcher Ebrahim Shafiei (EbraSha) discovered this vulnerability on October 27, 2024. It exploits... In "Cybersecurity News - Original News Source is cybersecuritynews.com" July 16, 2026 A newly disclosed zero-day flaw in AnyDesk, tracked as CVE-2026-15682, allows local attackers to crash affected installations by abusing a core support feature, raising fresh concerns for organizations relying on the remote desktop tool for IT support and access management. The vulnerability resides in AnyDesk's Send Support... In "Cybersecurity News - Original News Source is cybersecuritynews.com" May 20, 2026 A proof-of-concept (PoC) exploit was published for a new Linux Local Privilege Escalation (LPE) vulnerability dubbed "PinTheft." Discovered by Aaron Esau of the V12 security team, the flaw allows local attackers to gain root access by exploiting an RDS zerocopy double-free bug. A kernel patch is currently... In "Cybersecurity News - Original News Source is cybersecuritynews.com"