High severity7.5NVD Advisory· Published Nov 6, 2025· Updated Jun 17, 2026

CVE-2025-27916

Description

An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an IP address, it is possible to manipulate the data and spoof the AnyDesk ID.

Affected products

Anydesk/Anydesk3 versions
cpe:2.3:a:anydesk:anydesk:*:*:*:*:*:windows:*:*+ 2 more
- cpe:2.3:a:anydesk:anydesk:*:*:*:*:*:windows:*:*range: <=9.0.4
- (no CPE)
- (no CPE)range: <9.0.6 (Windows), <8.0.0 (Android)

Patches

Vulnerability mechanics

References

dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdfnvdExploitThird Party Advisory
anydesk.com/en/changelog/windowsnvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000