The vulnerability is a heap-based buffer overflow in AnyDesk's stream packet handler for mode 5. The server does not validate the payload length field, allowing an attacker to send a crafted packet that overflows a heap buffer and executes arbitrary code as the root user. Because the flaw is triggered by unauthenticated traffic, the attacker does not need credentials or user approval to gain control over the target machine.

AnyDesk clients or servers running AnyDesk versions prior to 8.0.3 on Linux are affected. The issue exists in all builds that use the vulnerable mode‑5 stream packet handling logic, with no known restrictions on the specific sub‑versions beyond the 8.0.3 cutoff.

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score of 2% suggests a moderate likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog at this time. Attackers can exploit the vulnerability remotely from any machine that can establish a session with the target, without authenticating. Successful exploitation can occur in the wild, and past proof‑offs demonstrate command execution as root on Linux systems.