AnyDesk Linux 8.0.2 Zero-Click Root RCE Urges Immediate Update to 8.0.3 Amid PoC Release

Remote attackers can seize full administrative control of Linux systems running AnyDesk 8.0.2 without needing user consent or valid credentials. This pre-authentication vulnerability, dubbed AnyPwn, allows arbitrary code execution with root privileges, representing a severe risk to organizations relying on the remote support tool for Linux environments.

The risk

The vulnerability stems from a heap buffer overflow in the session protocol handling data during remote connections. According to technical documentation from V12 Security, the mode-5 stream packet handler accepts a payload length before validating it safely. The software then adds a 16-byte object header using 32-bit arithmetic, which can cause the calculation to wrap around.

View the original post on X

This arithmetic error leads the application to reserve a tiny memory area while treating it as a much larger object. Attackers can send a small network packet that instructs AnyDesk to expect a massive amount of data. The service then writes attacker-controlled data beyond the allocated memory, creating an out-of-bounds write condition that corrupts nearby memory objects.

Under the right conditions, this corruption redirects program execution, allowing attackers to run arbitrary commands through the AnyDesk service. Because the service typically runs with root privileges on Linux, successful exploitation grants the highest level of system access, including control over files, processes, and security settings.

Who is exposed

AnyDesk Linux version 8.0.2 is directly affected by this flaw. The issue was discovered by Rick de Jager of the V12 security team using their AI-powered security review platform. V12 initially disclosed the problem publicly in June, describing it as a zero-click remote code execution flaw.

AnyDesk acknowledged the report the following day and released version 8.0.3 in June to address the issue. However, the public release of exploit code on October 8 has renewed attention on systems still running the vulnerable build. Organizations that have not updated since June remain exposed to unauthenticated attacks.

Cost and compliance

The security impact is severe because attackers can establish a strong foothold on the host before a victim accepts any desktop-sharing request. This differs significantly from many remote-support risks that require stolen credentials, user approval, or unattended-access passwords. The ability to bypass authentication entirely increases the likelihood of successful intrusions.

What happens next

Managers should verify that all Linux instances are running AnyDesk version 8.0.3 or later. It is also critical to check whether TCP port 7070 is exposed to untrusted networks, as this port facilitates the vulnerable connection. Immediate patching is the primary defense against this known exploit.

What to do and how to stay safe: AnyDesk

• Audit all Linux servers and workstations to ensure AnyDesk is updated to version 8.0.3 or newer.
• Review firewall rules to block inbound connections to TCP port 7070 from untrusted networks.
• Monitor system logs for unusual AnyDesk activity or unexpected root-level command executions.
• Verify that remote access solutions are not running with unnecessary elevated privileges.

Step-by-step guide: Phishing Myths Debunked: Why Common Beliefs Leave You Vulnerable

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which AnyDesk versions are vulnerable to AnyPwn?

AnyDesk Linux version 8.0.2 is vulnerable. Version 8.0.3 includes the fix for this issue.

Do attackers need user approval to exploit this flaw?

No, the vulnerability allows remote code execution without authentication or user approval.

When was the exploit code made public?

The public exploit code was released on October 8, according to Cyber Security News.