CVE-2025-27918

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.53%
EPSS Percentile: 43.19%
CISA KEV: Not listed

Description

An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 07-Nov-2025 01:15
Last Modified: 17-Jun-2026 16:04
EPSS Date: 2026-10-10
CWE: CWE-190

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

anydesk / anydesk
Version / affected range: * · before (exclusive) 9.0.0
cpe:2.3:a:anydesk:anydesk:*:*:*:*:*:windows:*:*

References

Last enrichment sync: 11-Oct-2026 11:15
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

A separate AnyDesk heap buffer overflow, CVE-2025-27918, was fixed in version 7.0.0 in April 2025. That vulnerability affected all AnyDesk platforms and involved an integer overflow in user image processing, a different Working Exploit for AnyDesk Linux Flaw Can Give Attackers Root Access

People (1)

Vendors (1)

Products (1)

Tools (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.