ZDI 26 400

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of screen recording files. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

03/25/25 ZDI submitted the report to the vendor’s SOC team 08/04/25 - ZDI followed up asking the vendor to confirm receipt 09/24/25 - due to lack of response, ZDI informed the vendor of the planned disclosure date 09/26/25 - the vendor’s support team confirmed escalating the issue to the Security Team 10/28/25 - ZDI followed up requesting a status update 12/11/25 - the vendor’s support team communicated that the issue was out of their scope 06/26/26 - ZDI notified the vendor of the intention to publish the case as a 0-day advisory

-- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product

Giuliano Sanfins from SiDi