Public Exploit Turns an Old AnyDesk Linux Bug Into Root Access: What Admins Need to Know

A bug that AnyDesk fixed in June with a one-line changelog note is back in the spotlight. Researchers have now released code that turns it into root access on Linux machines running an older build of the remote desktop tool, and no one has to approve the incoming session first.

The answers below are based on Swati Khandelwal’s write-up at The Hacker News.

What changed this week?

On October 8, the researchers posted a full working exploit, named AnyPwn, on GitHub. Until then the problem was known mainly as a crash fix. AnyDesk shipped version 8.0.3 in June and described the change only as fixing “a bug that could lead to a crash.” There was no CVE and no security advisory, and as of October 9 there still was neither.

Which systems are affected?

Only AnyDesk on Linux. AnyDesk said in June that the issue is limited to direct Linux connections that don’t pass through its relay servers, and that Windows and macOS are not affected. The published exploit is tuned for build 8.0.2. The researchers suggest older builds such as 8.0.1 may share the same weak code, but that has not been confirmed.

How does the attack work, in plain terms?

When AnyDesk receives a certain kind of session packet, it works out how much memory to set aside by adding a small header to the length the sender claims. That math isn’t checked for overflow. By claiming an enormous length, the attacker makes the total wrap around to zero, so only a tiny buffer gets reserved while the program still believes it is huge. Incoming data then spills into neighboring memory, and the exploit uses that to run a command as root.

Is it reliable?

Not every time. The memory layout has to line up just right, and when it doesn’t, the AnyDesk service crashes instead. The exploit also only works over direct TCP connections on port 7070. The researchers say the same weak code can be reached through AnyDesk’s relays, but they did not show a full attack that way, so that question is still open.

Who found it?

Rick de Jager of the V12 security team, using V12’s code review engine. The researchers announced the flaw on June 22, AnyDesk acknowledged it the following day, and the fixed 8.0.3 release followed.

Is this related to earlier AnyDesk problems?

No. A different memory bug, CVE-2025-27918, was fixed in version 7.0.0 in April 2025 and affected every platform. Separately, AnyDesk’s own production systems were breached in early 2024. Neither is the same issue as AnyPwn.

What should admins do?

• Update AnyDesk on Linux to 8.0.3 or newer. The current release is 8.1.0.
• If an update has to wait, restrict who can reach TCP port 7070 on those machines.

What this means for your company

Remote access tools sit on a lot of small business systems, often installed once by a vendor or a former IT contractor and then forgotten. A quiet fix with no CVE means many scanners and patch reports will never flag this one, so you have to look for it yourself.

• Inventory every remote access tool on your servers and workstations, including Linux boxes, kiosks and appliances, and note who installed each one and why.
• Remove what nobody uses. An unused remote desktop agent is pure risk.
• Keep remote tools off the open internet. Block direct inbound ports at the firewall unless there is a documented reason to allow them.
• Don’t rely only on CVE feeds. Read vendor changelogs for the tools that can reach your network, and treat “crash fixes” in network-facing software as possible security fixes.
• Standardize on one managed remote access method with multifactor sign-in and logging, so you know every session that touches your systems.

Need help finding stray remote access tools on your network and replacing them with something you can actually monitor? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.

About The Author

L7 News

See author's posts