AnyPwn: AnyDesk Pre-auth Heap Buffer Overflow RCE PoC Published

A public proof-of-concept exploit named AnyPwn targets AnyDesk for Linux and claims pre-authentication remote code execution. The PoC is published on GitHub under the v12-security/pocs repository, and the affected version cited in coverage is AnyDesk Linux 8.0.2. The claimed primitive is a heap buffer overflow that requires no credentials and yields code execution as root on the host running the AnyDesk service.

The severity comes from the combination: AnyDesk is a remote-access tool that is frequently exposed to the internet for IT support, a pre-auth memory-corruption bug in that position means an unauthenticated attacker could take full control of the endpoint, and root-level execution on Linux means the entire host is lost, not just the user session. No CVE identifier is attached yet and no vendor advisory appears in the record, so the flaw's exact trigger conditions, affected version range, and patch status remain unconfirmed.

Treat the PoC as a lead rather than a confirmed working exploit until AnyDesk publishes an advisory or independent researchers reproduce it. Worth watching: any vendor statement or fixed release, whether a CVE is assigned, evidence of in-the-wild scanning or exploitation of AnyDesk endpoints, and whether defenders report mass scanning, since a public pre-auth RCE against remote-access software typically draws opportunistic attackers within days.