TeamViewer Fixes a Flaw That Lets a Remote Host Attack the Viewer

A TeamViewer vulnerability, CVE-2026-111585, lets a malicious or compromised computer attack the person who connects to it, according to TeamViewer’s security bulletin TV-2026-1011. The company has fixed it, with two other client flaws, in version 15.83, and says all users should update “as soon as possible”.

The usual worry with remote-access software is someone breaking into the machine being controlled. This bug runs the other way. Researchers at Remedio, who found it, describe it as a way to reach the IT support technician’s own computer from the machine they connect to help. TeamViewer rates it 8.8 out of 10 and says: “At the time of publication, TeamViewer is not aware of any active exploitation in the wild.”

How the TeamViewer vulnerability works

The bulletin describes an integer overflow in the part of TeamViewer clients that processes the remote screen during a remote-control session. It “may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process”, TeamViewer says. “Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.”

Remedio’s write-up, by researcher Omri Dar and published on 29 October, explains the cause as a single size calculation done in 32-bit arithmetic. A hostile host can announce screen dimensions that make the viewer set aside far too little memory, then send screen data that writes past the end of it. Remedio says the host can also refuse the normal video codecs to force the viewer onto the vulnerable path.

At the low end, Remedio says, “a hostile machine can crash the technician’s TeamViewer whenever it wants”. At the high end it says it ran a program of its choosing on a Windows viewer, bypassing the Control Flow Guard and DEP protections. That demonstration has a caveat Remedio states itself: one step, arranging memory in advance, was handled by a hook on the host rather than sent over the wire.

Remedio reported the flaw to TeamViewer on 14 August. It says TeamViewer accepted the finding on 22 October and shipped the fix in 15.83 on 27 October. It found the vulnerable code still present in version 15.82.

Two more client flaws, and a separate add-on bulletin

The same bulletin fixes CVE-2026-92372, also rated 8.8, an out-of-bounds write in the screen-image decoder of the Full Client for Linux and macOS. TeamViewer says an attacker could run code by sending crafted screen-image data during a remote-control session, or by persuading a user to open a crafted TeamViewer session recording (.tvs file). User interaction is required.

The third, CVE-2026-92374, rated 7.8, affects the Full Client and Host on macOS. A race condition in a privileged helper lets a local attacker with low privileges get round installer package checks and could lead to root access. TeamViewer lists TeamViewer Remote, Tensor and ONE as the affected products.

A second bulletin issued the same day, TV-2026-1012, covers six local privilege escalation flaws in TeamViewer’s Remote Management add-ons for monitoring, asset management and patch management, rated up to 7.8. All need a local attacker who is already signed in. TeamViewer says those components update automatically, and again that it is not aware of exploitation.

Fixed versions

TeamViewer lists these fixed builds for TV-2026-1011:

• Full Client and Host (Windows, Linux, macOS): 15.83
• TeamViewer Portable (Windows): 15.83
• Remote Control app (Android): 15.83
• Legacy 15.64 (Windows 7 and 8): 15.64.10
• Legacy 14.7 (Windows, Linux, macOS): 14.7.48868
• Legacy 13.2: 13.2.36231 (Windows), 13.2.154008 (Linux), 13.2.154007 (macOS)

Why support desks should update TeamViewer first

The people most exposed to this TeamViewer vulnerability are the ones who connect out to other machines for a living: help desks, managed service providers and in-house IT teams. Their computers often hold admin credentials and access to many customer networks, which makes the viewer a more valuable target than the machine being fixed. A customer PC that is already infected, or a stranger posing as someone who needs help, is the kind of host the bulletin describes.

That should set priorities, not panic. There is no sign anyone has used the bug, and an attacker cannot simply reach out to a TeamViewer install; the victim has to connect to the hostile host. But that is exactly what support staff do all day, and Remedio has now published a detailed account of how the bug works. Security teams have seen how fast published flaws draw attention: Oracle’s E-Business Suite bug drew exploit attempts within days of its patch, and Cisco’s ASA and FTD VPN flaw was already being exploited when it was disclosed.

The practical step is to update support and admin machines to 15.83 first, then the rest of the estate, and to check for older 13.x, 14.x and 15.64 installs that need the legacy builds. Portable copies and Android phones used for remote support are easy to miss. Until they are patched, staff should be cautious about connecting to machines they cannot vouch for, and should not open .tvs recordings from unknown sources.

The pattern is familiar from the flaws Anthropic’s red team found in Chrome and other software: the fix arrives before most people hear of the bug, and the risk sits in machines that never install it. More patch advice is in TSN’s Ransomware & Cyber Attacks hub.

Sources

• TeamViewer: Security bulletin TV-2026-1011, Security Update for Vulnerabilities in TeamViewer Clients, 27 October 2026 (updated 28 October)
• Remedio (Omri Dar): Remote Code Execution in TeamViewer, 29 October 2026
• TeamViewer: Security bulletin TV-2026-1012, Security Update for TeamViewer Remote Management Add-ons, 27 October 2026 (updated 28 October)

Related stories

• Cisco Patches ASA and FTD VPN Zero-Day That Attackers Are Using
• Anthropic Says Unreleased AI Found 62 Chrome Flaws, All Now Patched
• Oracle EBS Flaw Draws First Exploit Attempts Days After Its Patch