A heap overflow in AnyDesk's session protocol (mode-5 stream packets) lets an unauthenticated attacker run commands as root on Linux before anyone approves the connection (CVSS 9.8). Affects 8.0.0 up to 8.0.3; AnyDesk fixed it in 8.0.3 on June 23 but its changelog only said "fixed a bug that could lead to a crash," so CVE-based scanners missed it until the CVE landed this week. V12 Security's public exploit (Oct 8) targets 8.0.2 over direct TCP port 7070 and is probabilistic; relay-based exploitation is unproven. Windows and macOS are not affected. Censys sees 175,838 hosts exposing TCP 7070 (not confirmed vulnerable). Fix: upgrade Linux installs to 8.0.3+ (8.1.0 current) and block direct 7070 exposure.