What is GHSA-p2jv-fpmf-jqjw?

GHSA-p2jv-fpmf-jqjw is a security advisory published by GitHub Security Advisories with Critical severity. AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap...

Which CVE IDs does GHSA-p2jv-fpmf-jqjw cover?

GHSA-p2jv-fpmf-jqjw covers the following CVE IDs: CVE-2026-109390. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p2jv-fpmf-jqjw?

GHSA-p2jv-fpmf-jqjw has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-p2jv-fpmf-jqjwCriticalCVSS 9.8

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-109390 →

📋 Description

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-109390
https://anydesk.com/en/changelog/linux
https://github.com/v12-security/pocs/tree/main/anydesk
https://github.com/advisories/GHSA-p2jv-fpmf-jqjw