AnyDesk vulnerabilities
We track 6 vulnerabilities in AnyDesk products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest AnyDesk vulnerabilities
- 9.8 Critical severity
AnyDesk: Improper Handling of Length Parameter Inconsistency
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode
- 8.2 High severity
Anydesk: Improper Access Control
An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without needing confirmation from the counterparty. Con
- 9.8 Critical severity
Anydesk: Integer Overflow or Wraparound
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow
- 7.5 High severity
Anydesk: NULL Pointer Dereference
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. Remote Denial of Service can occur because of incorrect deserializa
- 7.5 High severity
Anydesk: Authentication Bypass by Spoofing
An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an IP address, it is possible to manipulate the data and spoof the AnyDesk ID.
- 7.1 High severity
Anydesk: Improper Link Resolution Before File Access
AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and chat) but the product runs as SYSTEM when writing chat-room data there.