AnyDesk for Linux flaw allows unauthenticated root code execution

CVE-2026-109390 in AnyDesk for Linux before 8.0.3 lets unauthenticated remote attackers execute code via a heap overflow in the mode-5 packet handler. A 32-bit addition of the 16-byte header to a declared length of 0xFFFFFFF0 wraps to zero, so a tiny buffer is allocated. CVSS is 9.8; the service runs as root and listens on TCP 7070.

• CVSS 9.8: network attack with no privileges or user interaction
• Length 0xFFFFFFF0 plus 0x10 wraps to zero in 32-bit arithmetic
• Fixed in 8.0.3, but without a CVE or advisory in the changelog
• ZoomEye: 461 matches for app="AnyDesk" and 1,750 for the title