Is CVE-2026-109390 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109390?

CVE-2026-109390 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-109390

Description

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.