Vulnerabilities

TeamViewer flaw lets a malicious host attack the technician

By Yaali. October 31, 2026, 6 min read, Vulnerabilities, Patching, Windows.

CVE-2026-111585 lets a hostile TeamViewer host crash the viewer or run code on it. Fixed versions, legacy builds, and how to check support PCs.

TeamViewer has fixed CVE-2026-111585, a heap overflow rated CVSS 8.8 that runs in the opposite direction to most remote access bugs. The machine being supported attacks the person supporting it. When a technician opens a remote control session to a host that an attacker controls or has compromised, that host can crash the technician's TeamViewer client and, according to the researchers who found it, run code on the technician's Windows PC with the technician's privileges.

The flaw affects the TeamViewer Full Client (including Portable) on Windows, macOS and Linux and the Remote Control app for Android, in every version before 15.83, which shipped on October 27. Version 15.82, the September security release, is still vulnerable. TeamViewer says it knows of no exploitation in the wild, and Remedio, the firm that reported the bug, has not released exploit code. Help desks, managed service providers and anyone who connects to machines they do not own should treat this as a priority update, because their technicians' workstations usually hold the credentials for everything else.

How it works

In a TeamViewer session the viewer is the side that watches and controls; the host is the machine on the other end. When a session opens, the host tells the viewer its screen geometry. The viewer then allocates a pixel buffer sized from that width, height and colour depth, and decompresses each incoming screen update into it.

The viewer accepts those dimensions without an upper limit and multiplies them in 32-bit arithmetic. Remedio's example is a declared surface of 32,768 by 32,768 pixels at 32 bits per pixel: the true size needs more than 32 bits to represent, so the result wraps around to a small number and the viewer allocates a buffer far smaller than the screen it was promised. This is an integer overflow (CWE-190 in TeamViewer's bulletin). The decoder still writes screen data for the full declared surface, so pixel data runs off the end of the buffer into neighbouring heap memory.

This decode path is the software fallback used when no hardware video decoder is available for the session. A hostile host does not have to hope the viewer lands on it: it can refuse codec negotiation and force the fallback. Remedio says the bug is reachable in TeamViewer's default configuration, with no password and no extra click once the technician starts the session.

At minimum the result is a crash, and the host can repeat it on every connection attempt. On Windows, Remedio went further. The researchers used the heap corruption to redirect a function call, get past Data Execution Prevention (DEP, which blocks running code from data memory) and Control Flow Guard (CFG, which restricts where indirect calls may jump), and reach WinExec, the Windows API that launches a program. TeamViewer's own wording is that code execution is possible "depending on the platform".

One caveat matters for risk ranking. Remedio's demonstration used a hook on the host side to substitute part of the attack data, so a fully network-delivered exploit has not been shown publicly, and code execution has only been demonstrated on Windows.

Who is exposed

The attacker needs a technician to connect to a machine the attacker controls. That is an ordinary day for support desks and managed service providers, whose staff connect to whatever end-user PC opens a ticket. It also fits existing fraud patterns: a fake customer, a fake vendor asking for help, or a single compromised endpoint inside a client network that waits for the help desk to log in. Remedio disclosed the bug to TeamViewer on August 14, TeamViewer confirmed it and assigned the CVE on October 22, and the fix and Remedio's write-up followed on October 27 and October 29. The flaw is not in CISA's Known Exploited Vulnerabilities catalog.

The same update fixes two more client bugs. CVE-2026-92372 (CVSS 8.8) is a missing bounds check in the screen-image decoder of the Full Client and Host on Linux and macOS, which allows code execution through crafted screen data in a session or through a crafted session recording (.tvs file). CVE-2026-92374 (CVSS 7.8) is a race condition with symbolic link handling in the macOS privileged helper that lets a local user install a malicious package and become root. A companion bulletin, TV-2026-1012, fixes six local privilege escalation flaws, all rated High, in the Remote Management add-ons: Monitoring, Advanced Asset Management and Patch Management.

What to do

1. Find every viewer. List each machine that runs the TeamViewer Full Client, a Portable copy or the Android Remote Control app, with its version. Technicians' laptops come first, then jump hosts and shared support PCs. Portable copies on USB sticks and in tool folders do not update centrally, so search file shares for them by hand.
2. Update to 15.83 or later on Windows, macOS, Linux and Android. On the legacy branches, TeamViewer lists 15.64.10 for Windows 7 and 8, 14.7.48868 for 14.7, and 13.2.36231 (Windows), 13.2.154008 (Linux) or 13.2.154007 (macOS) for 13.2. The bulletin does not list the Host as affected by CVE-2026-111585, but Host installs need 15.83 anyway for the other fixes in the same release.
3. Update the Remote Management components: Monitoring 26.10.1 and Patch Management 26.9.1 (24.12.5 for clients on 14.7). They normally arrive by automatic update, so confirm the version in the console rather than assuming it.
4. Until a viewer is patched, do not use it to connect to machines you cannot vouch for. TeamViewer lists no workaround, so this is the only interim control. Route unknown or first-time customers to a patched workstation.
5. Check for signs of an attempt. On Windows the viewer records outgoing sessions in %AppData%\TeamViewer\Connections.txt, one row per session with the partner ID, start and end time and Windows user. Match technician reports of TeamViewer crashing at session start against that file, and against Windows Error Reporting entries for TeamViewer.exe in the Application event log (Event ID 1000). A crash right after connecting to a new partner ID deserves a look at what ran on the technician's PC next.
6. If a viewer may have been hit, treat the technician workstation as compromised. Rebuild it, then rotate what it held: the technician's domain and password manager credentials, saved TeamViewer account sessions and any stored passwords for client systems.

The wider lesson

Support teams usually harden the hosts they connect to and treat the viewer as the safe end. This bug is a reminder that every byte a remote host sends is untrusted input, and that the technician's PC is the more valuable target. Keep viewer clients on the same fast patch cycle as browsers, keep Portable copies out of general use, and run support sessions from accounts that do not hold domain admin rights, so a compromised viewer gets less.

We test remote access tooling and support workflows in our safeguarding and hardening work, and watch for suspicious session activity in security operations. If you want help finding every TeamViewer viewer in your estate or checking a crash you have seen, open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: TeamViewer bulletin TV-2026-1011, TeamViewer bulletin TV-2026-1012, SecurityWeek, Hackread, The Hacker News, heise online, Canadian Centre for Cyber Security AV26-1093.