CVE-2025-27917

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

AnyDesk for Windows before 9.0.5, macOS before 9.0.1, Linux before 7.0.0, iOS before 7.1.2, and Android before 8.0.0 has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.

AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability.

A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by abusing the 'Send Support Information' feature. The attack requires prior low-privileged code execution on the target system.

A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by manipulating screen recording files. The attacker must first obtain the ability to execute low-privileged code on the target system.

AnyDesk version 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during application startup or system reboot.

AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges. Attackers can inject malicious executables that will run with high-level system permissions.

In AnyDesk through 9.0.4, a remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without confirmation from the counterparty. The attacker can then connect later without that confirmation.

An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an IP address, data can be manipulated and the AnyDesk ID spoofed.

AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link. The user can write to their own %APPDATA% folder (used for ad.trace and chat), but the product runs as SYSTEM when writing chat-room data there.