CVE-2025-27917: 
AnyDesk vulnerability analysis and mitigation

A remote Denial of Service vulnerability (CVE-2025-27917) was discovered in AnyDesk through version 9.0.4. The vulnerability was disclosed on November 6, 2025, and affects the Windows platform. The issue stems from incorrect deserialization that results in failed memory allocation and a NULL pointer dereference (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 7.5 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U) with no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) (NVD).

When successfully exploited, this vulnerability can cause a remote Denial of Service condition in AnyDesk installations, potentially making the service unavailable to legitimate users. The high availability impact score indicates that the exploitation can completely deny access to the targeted system or service (NVD).

The vulnerability was addressed in AnyDesk version 9.0.5 and later releases. Users are advised to upgrade to the latest version to mitigate this security risk. The fix was part of a broader update that included multiple security improvements and bug fixes (AnyDesk Changelog).