ZDI 2026-07-08

ZDI-26-401: (0Day) AnyDesk Support Information Link Following Denial-of-Service Vulnerability

Machine-generated analysis · WAYSCloud LLM

The vulnerability requires local code execution to trigger a denial-of-service condition via link following in AnyDesk.

Context

The affected product is AnyDesk, a remote desktop application. The vulnerability is a local denial-of-service condition that arises from link following within the support information feature. An attacker must already have the ability to run low-privileged code on the system. The CVSS score is rated at 4.7, indicating a medium severity impact.

Operator considerations

Check: Determine if AnyDesk is installed on systems where local access is a concern.

From Zero Day Initiative ↗

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.7.

Read the full advisory on ZDI →