AnyDesk Printer COM Impersonation LPE — Elevated Child Process Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects anomalous child process execution spawned by the AnyDesk service, indicative of exploitation of the adprinterpipe named pipe. This vulnerability involves a low-privileged attacker supplying malicious IStream bytes to the service to trigger code execution in the SYSTEM context.