Heap-based Buffer Overflow in AnyDesk's Identity User Image Processing
CVE-2025-27918

9.8CRITICAL

Key Information:

Vendor

AnyDesk
Status
AnyDesk
Vendor
CVE Published:
6 November 2025

What is CVE-2025-27918?

An issue has been identified in AnyDesk prior to version 9.0.0 where an integer overflow occurs, leading to a heap-based buffer overflow. This vulnerability can be exploited through malicious UDP packets, particularly during the processing of user identity images within the Discovery feature or while establishing connections between clients. This flaw poses significant risks, allowing potential attackers to manipulate memory and execute arbitrary code.

References

https://anydesk.com/en/changelog/windows
https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-D...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.