Dashboard / CVE-2025-27918

CVE-2025-27918

CRITICAL
INFO Priority: 0.07 BB Relevance: 80/100
Published: 2025-11-06 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
anydesk anydesk < 9.0.0

References & Advisories (2)

Bug Bounty Relevance

80 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.70%
Raw Score 0.006990
Percentile 53.4%
Date 2026-11-09

EPSS Trend

2026-11-09
0.00699
2026-11-08
0.00699
2026-11-07
0.00699
2026-11-06
0.00699
2026-11-05
0.00699

Intelligence Sources

nvd ref →

External Links