CVE-2025-27918 Integer overflow in n/a
An integer overflow in AnyDesk allows remote attackers to execute arbitrary code or cause a denial of service via crafted UDP packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27918?
CVE-2025-27918 is a critical vulnerability in n/a, published on 6 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.
Weakness: CWE-190
Which versions are affected by CVE-2025-27918?
It affects 1 product.
Products include Anydesk Anydesk.
How do I fix CVE-2025-27918?
No fix has been published for CVE-2025-27918 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27918 being exploited?
There is no known exploitation of CVE-2025-27918 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xfj8-gxhp-pgmr.