CVE-2025-27917
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service in AnyDesk clients through incorrect deserialization that leads to memory allocation failures and NULL pointer dereferences. It affects AnyDesk users on Windows, macOS, Linux, iOS, and Android platforms. The vulnerability can be triggered remotely without authentication.
💻 Affected Systems
- AnyDesk for Windows
- AnyDesk for macOS
- AnyDesk for Linux
- AnyDesk for iOS
- AnyDesk for Android
📦 What is this software?
Anydesk by Anydesk
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers can crash AnyDesk client applications, disrupting remote access sessions and potentially causing service unavailability for affected systems.
Likely Case
Remote denial of service causing AnyDesk client crashes, requiring application restart and interrupting active remote sessions.
If Mitigated
With proper network segmentation and access controls, impact is limited to denial of service for the AnyDesk application only.
🎯 Exploit Status
The vulnerability requires network access to the AnyDesk client but no authentication. Exploitation details are documented in academic research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Windows: 9.0.5+, macOS: 9.0.1+, Linux: 7.0.0+, iOS: 7.1.2+, Android: 8.0.0+
Vendor Advisory: https://anydesk.com/en/changelog/windows
Restart Required: Yes
Instructions:
1. Download latest AnyDesk version from official website 2. Install over existing installation 3. Restart AnyDesk service/application 4. Verify version is updated
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to AnyDesk clients using firewall rules
# Example firewall rule to block AnyDesk ports
# Windows: netsh advfirewall firewall add rule name="Block AnyDesk" dir=in action=block protocol=TCP localport=6568,7070
# Linux: sudo iptables -A INPUT -p tcp --dport 6568 -j DROP && sudo iptables -A INPUT -p tcp --dport 7070 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can connect to AnyDesk clients
- Monitor for AnyDesk application crashes and investigate any unusual patterns
🔍 How to Verify
Check if Vulnerable:
Check AnyDesk version against affected version ranges. On Windows: Help > About; On Linux: anydesk --version; On macOS: AnyDesk menu > About AnyDeskCheck Version:
Windows: anydesk.exe --version, Linux: anydesk --version, macOS: /Applications/AnyDesk.app/Contents/MacOS/AnyDesk --versionVerify Fix Applied:
Confirm version is equal to or higher than patched versions: Windows 9.0.5+, macOS 9.0.1+, Linux 7.0.0+, iOS 7.1.2+, Android 8.0.0+📡 Detection & Monitoring
Log Indicators:
- AnyDesk application crash logs
- Unexpected termination of AnyDesk process
- Error logs containing memory allocation failures or NULL pointer references
Network Indicators:
- Unusual traffic patterns to AnyDesk default ports (6568, 7070)
- Multiple connection attempts followed by service disruption
SIEM Query:
source="AnyDesk" AND (event_type="crash" OR message="*memory*" OR message="*NULL*" OR message="*deserialization*")