CVE-2026-15681
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by manipulating screen recording files. The attacker must first obtain the ability to execute low-privileged code on the target system.
Risk Assessment
The organization faces the risk of service disruption for AnyDesk, which can impact remote access and technical support, potentially affecting user productivity.
Recommendation
It is recommended to immediately update AnyDesk to the latest patched version and restrict local user privileges to the minimum necessary for their tasks.
Other vulnerabilities in AnyDesk
See all- CVE-2017-14397Critical
AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability.
- CVE-2026-15682Medium
A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by abusing the 'Send Support Information' feature. The attack requires prior low-privileged code execution on the target system.
- CVE-2016-20094High
AnyDesk version 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during application startup or system reboot.
- CVE-2022-32450High
AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link. The user can write to their own %APPDATA% folder (used for ad.trace and chat), but the product runs as SYSTEM when writing chat-room data there.
Original NVD description (English source)
AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of screen recording files. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26591.