VulnSocial

CVE-2026-109390

LOWCVSS 9.8 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-130

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked at 3 mentions on most recent observed day (2026-10-13)
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01223Mentions · 2026-10-12: 2Mentions · 2026-10-13: 310-1210-13
Referenced assets2 URLs
Full discourse5 posts
  • transilienceai@gettransilience

    🚨 AnyDesk Linux pre-auth RCE as root (CVE-2026-109390, CVSS 9.8). Public "AnyPwn" PoC is out. Versions 8.0.0 to 8.0.2 are affected. An integer wrap in the mode-5 packet handler causes a heap overflow on TCP/7070, with no auth and no user click needed. AnyDesk fixed it quietly in 8.0.3 in June and described it only as a "crash fix." Researchers say it can also be reached through AnyDesk's relays. Upgrade to 8.0.3+ now. Until you can, block inbound 7070. Look for repeated anydesk crashes, child processes spawned by AnyDesk, and /tmp/anypwn. Full Advisory in comments

    1103044
    10 followersView on X
  • Harmonic Society株式会社｜千葉のホームページ制作@hs230303

    AnyDeskに、認証なしで突かれる脆弱性（CVE-2026-109390）が見つかって、実証コードまで出てるらしい。6月の8.0.3で修正済みなので、リモート保守で使ってる会社はバージョンだけ確認しとこう。

    1000018
    18 followersView on X
  • Hephaestvs@Vulcanux_

    csirt_it: ‼️ #PoC #AnyDesk: disponibile Proof of Concept (PoC) per la vulnerabilità identificate tramite CVE-2026-109390 Rischio: 🔴 Tipologia: 🔸 Remote Code Execution 🔗 https://www.acn.gov.it/portale/w/anydesk-disponibile-poc-pubblico-per-la-cve-2026-109390 ⚠️ Importante mantenere aggiornati i sistemi https://t.co/pV8l0KK3q3

    0000024
    641 followersView on X
  • Severity Daily@severitydaily

    AnyDesk fixed pre-auth root execution on Linux in June and called it “a bug that could lead to a crash.” The CVE landed today, four days after a working exploit went public. No exploitation reported. https://severitydaily.com/anydesk-cve-2026-109390-pre-auth-root-linux-8-0-3-changelog-a-bug-that-could-lead-to-a-crash/

    0000055
    34 followersView on X
  • Daily CyberSecurity@Daily_CyberSec

    This flaw is tracked as CVE-2026-109390.

    00000119
    13.0K followersView on X

Explore more

Back to dashboard