Executive Summary
AnyPwn is a critical heap buffer overflow vulnerability affecting AnyDesk for Linux, specifically demonstrated against version 8.0.2. Identified by Rick de Jager of the V12 security team, the flaw resides in the session protocol's mode-5 stream packet handler. By manipulating 32-bit integer arithmetic during allocation size calculations, an attacker can trigger a wrap-around leading to an undersized heap buffer, followed by an overflow that grants remote code execution (RCE).
Technical analysis shows the exploit achieves RCE before a user approves the incoming connection request, bypassing a primary security boundary. Because the AnyDesk service typically runs with elevated privileges on Linux, successful exploitation leads directly to root-level access. While a public proof-of-concept (PoC) exists, the exploit is probabilistic and sensitive to heap layout, often causing service crashes if memory alignment is not precise.
This vulnerability was addressed in AnyDesk version 8.0.3, released in June 2026. However, the lack of a detailed security advisory at the time of the fix may have led to delayed patching. Organizations should prioritize updating to version 8.0.3 or later (currently 8.1.0) and restrict access to the default listener on TCP port 7070.
Key Details
Threat Name
AnyPwn
Affects
AnyDesk for Linux
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified