CVE-2025-27918: Critical Heap Overflow in AnyDesk via UDP Discovery

CVE-2025-27918 is a critical (CVSS 9.8) integer overflow and heap buffer overflow in AnyDesk. A UDP packet processed in the Discovery feature, or when two clients connect, triggers it. Update to Windows 9.0.5, macOS 9.0.1, Linux 7.0.0, iOS 7.1.2 or Android 8.0.0, or newer.

What's affected

The record lists these versions as affected: AnyDesk for Windows before 9.0.5, for macOS before 9.0.1, for Linux before 7.0.0, for iOS before 7.1.2 and for Android before 8.0.0. The fixed versions are therefore those numbers or later.

The record says the overflow happens while processing an Identity user image within the Discovery feature, or when establishing a connection between any two clients. The reference list includes the AnyDesk Windows changelog and a university thesis from CTU Prague.

Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-190 (Integer overflow or wraparound).

How to check if you're exposed

Check the version on each device.

• Windows: open AnyDesk, then the menu and About.
• macOS: AnyDesk menu, About AnyDesk.
• Linux: run anydesk --version, or check your package manager with apt list --installed 2>/dev/null | grep -i anydesk.
• iOS and Android: open the app store page for AnyDesk and compare, or read the version in the app settings.

Inventory is the hard part. Remote access tools are often installed by individuals, so look for them with your endpoint management tool and your network logs, not only your software list. Also see whether Discovery is enabled in the client settings.

What to do now

1. Update every AnyDesk client to the fixed version for its platform, or later.
2. Use endpoint management to find installs you did not know about, including portable copies, and remove those you do not need.
3. Block inbound AnyDesk traffic from the internet where it is not needed, and restrict it on internal networks to where it is part of a managed process.
4. If Discovery is not needed, turn it off in the client settings.
5. Review remote session logs for unknown connections and check who has the unattended access password.
6. Add a rule to your software inventory to alert on AnyDesk versions older than the fixed ones.

Why it matters

CWE-190 is an integer overflow or wraparound. When a program calculates a size with a number that wraps past its maximum, the result can be small, the program allocates too little memory, and a later copy writes past the end of the buffer. The record describes that chain: an integer overflow followed by a heap based buffer overflow, triggered by data in a UDP packet.

The score is 9.8 because the vector is network based, needs no login and no user action, and rates all three impacts as high. Remote access software is also a favourite target, because a bug in it can give control of the machine and the network it sits on. UDP packets can be sent without a session, which widens who can reach the code.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• AnyDesk Windows changelog
• Thesis cited by the record (CTU repository)
• Safeguard Gold entry for CVE-2025-27918

Last reviewed: 19 October 2026.