🚨 AnyPwn: Public Exploit Raises Risk for Unpatched AnyDesk Linux Hosts

V12 Security researchers published a working proof of concept called AnyPwn on 8 October 2026 for a pre-authentication remote code-execution flaw in AnyDesk for Linux 8.0.2. The reported exploit targets the Linux x86_64 service-mode process and connects directly over TCP port 7070.

The issue is described as a heap buffer overflow triggered by unchecked 32-bit length arithmetic in session-protocol handling. In the demonstrated path, a remote unauthenticated peer can potentially execute commands as root before an incoming session is approved. Exploitation is probabilistic: the memory layout matters, and failure can result in a service crash instead of code execution.

AnyDesk’s Linux changelog lists version 8.0.3 on 23 June 2026 with a generic crash-related fix note. The public PoC appeared more than three months later. That timing makes asset inventory and patch verification important even though the fix predates the public exploit.

• Target: AnyDesk for Linux 8.0.2, with the public demonstration described for Linux x86_64 service mode.
• Network path: direct TCP connectivity to port 7070 in the demonstrated exploit.
• Bug class: heap buffer overflow associated with session-protocol handling and unchecked 32-bit length arithmetic.
• Potential impact: root-level command execution before the incoming session is approved, when exploitation succeeds.
• Reliability: probabilistic; unfavourable heap layout may cause the service to crash instead.

The exploit code and payload instructions are not reproduced here. The defensive value of the report is the affected-build scope, network exposure, patch history and observable failure patterns.

At a high level, the session handler uses a declared packet length in a buffer-size calculation. If the calculation uses unchecked 32-bit arithmetic, a sufficiently large value can wrap around and produce an allocation that is smaller than the incoming data the program later handles.

Overflowing the allocated object can corrupt adjacent heap data. The public demonstration then attempts to shape memory so the corrupted data can redirect execution through code-reuse techniques. No universal success is implied: offsets and memory layout are build-dependent.

This is a remote memory-corruption path in a network-facing service. It is not a claim that all versions or all operating systems of AnyDesk share the same vulnerable code.

The reported public PoC depends on a reachable direct TCP/7070 service and a memory layout that allows the overflow to affect a suitable adjacent object. The researchers’ demonstration uses heap shaping to increase the chances of reaching the desired layout.

Reporting has not established a complete exploit chain over relayed connections. The demonstrated exploit path should therefore be described as direct TCP/7070, while broader relay-path claims remain unconfirmed in the materials reviewed.

The important operational point is to patch by product version and vendor release notes, not to wait for a CVE feed to tell you that a fix was security-relevant.

The key disclosure lesson is not that the vendor provided no fix: the vendor changelog dates 8.0.3 to June. The visibility gap was that the changelog wording, as reported, did not clearly convey the security significance to administrators monitoring release notes.

Do not publish speculative victim names or fabricate indicators of compromise. This is vulnerability intelligence, not an attributed intrusion report.

• High privilege: remote-access services may run with elevated privileges, increasing impact if process execution is achieved.
• Network exposure: a reachable management service can be targeted without a phishing email or stolen password when the flaw is pre-authentication.
• Asset blind spots: endpoint inventories may record the product name but not the exact Linux build or connection mode.
• Security-update visibility: a generic crash note can be missed by teams that only follow published CVEs and formal advisories.
• Incident response impact: a compromised remote-access host may expose local secrets and become a stepping stone for further activity.

The supplied research document contains no verified incident-specific IOCs. Detection should focus on exposure, version, abnormal service behaviour and post-exploitation telemetry rather than searching for invented IP addresses or domains.

These are defensive hunting ideas, not signatures proven against a confirmed in-the-wild campaign. Interpret them with version and process context to reduce false positives.

The mapping describes a potential exploitation concept. The available materials do not identify a confirmed victim, intrusion timeline or attacker campaign for this flaw.

CRL assesses this as a high-priority patching issue for any environment still running the demonstrated vulnerable Linux build. Risk is highest where AnyDesk Linux 8.0.2 is exposed to untrusted direct TCP/7070 connections and the service runs with root privileges.

The risk should not be overstated: the public PoC is build-specific and probabilistic, the fix has been available in Linux 8.0.3 since June, and the sources reviewed did not confirm exploitation in the wild as of 9 October 2026. Those qualifications do not justify leaving an affected exposed host unpatched.