CVE-2025-27918
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on AnyDesk clients by sending specially crafted UDP packets. The integer overflow leads to heap-based buffer overflow during identity image processing or connection establishment. All AnyDesk users on affected versions are at risk.
💻 Affected Systems
- AnyDesk for Windows
- AnyDesk for macOS
- AnyDesk for Linux
- AnyDesk for iOS
- AnyDesk for Android
📦 What is this software?
Anydesk by Anydesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to complete system compromise, lateral movement, and data exfiltration.
Likely Case
Remote code execution with user privileges, enabling malware installation, credential theft, and persistence establishment.
If Mitigated
Denial of service or application crash if exploit fails or controls block execution.
🎯 Exploit Status
UDP-based exploitation requires no authentication. Technical details are documented in academic paper.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Windows: 9.0.5+, macOS: 9.0.1+, Linux: 7.0.0+, iOS: 7.1.2+, Android: 8.0.0+
Vendor Advisory: https://anydesk.com/en/changelog/windows
Restart Required: Yes
Instructions:
1. Open AnyDesk. 2. Go to Settings > About. 3. Click 'Check for updates'. 4. Install available update. 5. Restart AnyDesk service/application.
🔧 Temporary Workarounds
Disable Discovery Feature
allPrevents UDP packet processing for identity images by disabling discovery.
Settings > Security > Uncheck 'Enable Discovery'
Block AnyDesk UDP Ports
allBlock UDP traffic to AnyDesk default ports (7070-7080) at firewall.
Windows: netsh advfirewall firewall add rule name="Block AnyDesk UDP" dir=in action=block protocol=UDP localport=7070-7080
Linux: sudo iptables -A INPUT -p udp --dport 7070:7080 -j DROP
🧯 If You Can't Patch
- Uninstall AnyDesk completely from affected systems.
- Implement strict network segmentation to isolate AnyDesk traffic.
🔍 How to Verify
Check if Vulnerable:
Check AnyDesk version in Settings > About and compare with patched versions.Check Version:
Windows: anydesk.exe --version, Linux: anydesk --version, macOS: /Applications/AnyDesk.app/Contents/MacOS/AnyDesk --versionVerify Fix Applied:
Confirm version is at or above patched versions: Windows 9.0.5+, macOS 9.0.1+, Linux 7.0.0+, iOS 7.1.2+, Android 8.0.0+.📡 Detection & Monitoring
Log Indicators:
- AnyDesk crash logs
- Unexpected process termination
- Memory access violation errors
Network Indicators:
- UDP packets to port 7070-7080 with malformed identity data
- Unusual outbound connections post-exploit
SIEM Query:
source="AnyDesk" AND (event_type="crash" OR message="*overflow*" OR message="*access violation*")