AnyPwn gives root on AnyDesk Linux before any connection is approved
On 8 October 2026, a public exploit named AnyPwn made a pre-authentication remote code execution flaw in AnyDesk Linux reliably exploitable: a heap overflow in the session protocol yields root, fixed in 8.0.3 but with no CVE and no security advisory. Update to 8.1.0 and restrict TCP port 7070 in the meantime.
22 June 2026. Researchers announce a security flaw in AnyDesk Linux. 8 October 2026. A public exploit, AnyPwn, turns the flaw into pre-authentication root. 9 October 2026. No CVE has been assigned and AnyDesk has issued no security advisory. Why it matters: AnyDesk is the remote access tool installed on millions of Linux machines; a remote code execution that yields root before anyone approves the connection is the worst possible outcome for software whose entire job is to let people in.
A fix that does not say what it fixes
The timeline is the most instructive part. AnyDesk fixed the flaw in June 2026, in version 8.0.3. But its changelog described the fix only as “fixed a bug that could lead to a crash”. No CVE, no security advisory, no mention of code execution. An administrator reading the changelog sees a stability fix, not a pre-authentication root vulnerability.
That silence turns a serious vulnerability into invisible risk. Teams that update based on security advisories — the recommended practice — received no signal to prioritise this update. The flaw stayed exploitable for everyone who had no reason to move to 8.0.3.
The most telling detail came after the exploit’s publication: AnyDesk’s download page no longer lists version 8.0.2, the exploit’s target, even though it still appears in the changelog. “The vendor appears to have deleted the 8.0.2 build of AnyDesk upon the release of our PoC video,” the researchers wrote, their surprise evident.
The overflow: 0xFFFFFFF0 + 0x10 wraps to zero
The flaw is a heap buffer overflow in AnyDesk’s session protocol, which uses “mode-5” stream packets. The handler sizes its backing allocation by adding a 16-byte header to the declared payload length, using 32-bit arithmetic without overflow checking.
The exploit declares a payload length of 0xFFFFFFF0. Adding 0x10 makes the 32-bit result wrap to zero: the allocator reserves a tiny buffer while the object keeps the original large length. A single byte of attacker data is then enough to write past the end of the allocation.
The overflow corrupts fields in adjacent heap objects, and the exploit uses a ROP chain to run an arbitrary command as root. That is the core of the severity: the flaw requires no prior authentication — the overflow happens in protocol handling, before any connection is approved.
What the exploit proves — and what it does not
AnyPwn works over direct TCP connections on port 7070. It is probabilistic: the heap layout must place a target object adjacent to the overflowed buffer, otherwise the service crashes instead of running the command. The offsets in the published code target a specific build — AnyDesk Linux 8.0.2 — and other builds would need different values.
The researchers say the same vulnerable code path is also reachable via AnyDesk’s relay servers, which the software uses when a direct connection is unavailable. They validated this with a Frida-instrumented trigger but did not demonstrate the full exploit chain over relays. AnyDesk said in June that the vulnerability was “limited to direct connections on Linux (connections that do not go through our relays)”, and that Windows and macOS were not affected.
Read that nuance carefully. A probabilistic, build-dependent exploit is harder to industrialise than a deterministic one, but it is still a pre-authentication root on a surface exposed by default. The relay question — resolved or not — does not change the urgency of fixing direct connections.
A broken chain of trust
The flaw was found by Rick de Jager of the V12 team, using V12, a security code review engine. V12’s founders previously built Zellic and led the competitive hacking team Perfect Blue. This is not an accidental find; it is automated review tooling applied to a widely deployed piece of software.
Nor is it the first flaw of this kind. AnyDesk fixed another heap overflow in April 2025, in version 7.0.0 — CVE-2025-27918 — which affected all platforms via an integer overflow in user image processing. The mechanism differs from AnyPwn’s, but the recurrence points to a pattern: session code that handles lengths without systematic overflow checks.
The surrounding context does not help trust, either. AnyDesk was hacked in early 2024 in a separate incident: its production systems were breached, leading to certificate revocations and forced password resets. A remote access tool that combines a history of compromise with silent fixes should be treated as a vector, not an inert utility.
What to do right now
The fix is simple, but the signal was so weak that you have to check the version actively.
# Check the installed version
anydesk --version
# 8.1.0 is the latest release; 8.0.3 is the minimum fixed version.
# Check for direct exposure of port 7070
ss -tlnp | grep 7070- Update to 8.1.0 (or at least 8.0.3). Versions 8.0.2 and earlier are vulnerable; 8.0.1 likely shares the faulty code path, even if its exploitation is unconfirmed.
- Restrict TCP port 7070 to trusted addresses if an immediate update is impossible. That is the containment measure that shrinks the surface most, since the published exploit travels over direct connections.
- Treat the missing CVE as risk, not denial. No identifier does not mean no flaw; it means your scanners will not surface it. The patch must come from the version, not the CVE feed.
- Audit your other remote access tools. The same pattern — open port, bespoke protocol, discreet fixes — applies to the whole remote access family.
Verdict
If you run AnyDesk on a Linux machine, update to 8.1.0 today and confirm nothing is listening on port 7070 with direct exposure — the public exploit moves the risk from theoretical to immediate. If you cannot update, cut direct network access to port 7070 and force traffic through a trusted gateway. If you are evaluating a remote access tool for your fleet, fold the quality of its security advisories into your criteria: a fix that does not say it fixes a pre-authentication RCE is as loud a warning as the flaw itself.