TeamViewer patches flaw letting compromised hosts attack support technicians’ computers

TeamViewer patched a vulnerability in its remote desktop software on Oct. 27, 2026, releasing version 15.83 to fix a flaw that lets a malicious or compromised host attack the computer of the technician or engineer connecting to it.

CVE-2026-111585 is an integer overflow in the component that processes screen updates. The problem appears when a host sends unusually large screen dimensions, for example 32,768 by 32,768 pixels, and can crash the viewer’s client repeatedly or run arbitrary code on the viewer’s system. It works through a buffer overflow that overwrites memory next to the intended area and can corrupt the heap during a live session. The CVSS severity score is 8.8 out of 10, in the high range, and reflects the potential for remote code execution and denial-of-service attacks.

TeamViewer said an attacker can exploit the flaw when a user accepts a remote-control session to a host under the attacker’s control or already compromised. The attack works in the default configuration and requires no password or extra clicks. That turns the usual trust relationship around, since the person connecting is normally expected to be the trusted party. IT support technicians and engineers face exposure when they remotely access and troubleshoot devices, and the flaw is highly exploitable in typical use.

Versions of TeamViewer Full Client before 15.83 are exposed on Windows, Linux, macOS, Windows Portable edition, and the Android Remote Control app. That list includes version 15.82, released in September 2026, which did not patch the issue. Users who moved to 15.82 in September 2026 remained exposed to CVE-2026-111585. TeamViewer’s bulletin names the Full Client, Portable, and Android app but does not explicitly list the Host, even though version 15.83 fixes other high-severity flaws affecting the Host.

TeamViewer also issued fixed legacy builds for older supported branches. Those include 15.64.10 for Windows 7 and 8, 14.7.48868 for legacy platforms, and platform-specific builds of version 13.2. The builds address vulnerabilities in older versions of the software.

Version 15.83 also repairs CVE-2026-92372, a flaw in how the software decodes screen images on Linux and macOS. A user who opens a malicious TeamViewer session recording with a .tvs extension could face arbitrary code execution, but that attack requires user interaction. That flaw carries an 8.8 score. The same update fixes CVE-2026-92374 on macOS, a time-of-check-to-time-of-use race condition — a timing flaw in which a check happens before the action it protects — that could let a low-privileged local attacker gain root privileges and carries a 7.8 score; exploiting it requires local access.

TeamViewer released advisory TV-2026-1012 on Oct. 27, 2026. It covers six high-severity flaws in the Remote Management add-ons that let a local user escalate privileges. The add-ons handle monitoring, patch management, and advanced asset management.

Remedio researcher Omri Dar reported the flaw to TeamViewer on Aug. 14, 2026. TeamViewer confirmed it on Oct. 22, 2026. Dar wrote up the flaw in a technical account released on Oct. 29, 2026.

His research explains how the host controls the declared surface and screen updates to trigger the overflow. Dar described the vulnerability as allowing the attacker, the host, to attack the victim, the viewer.

Remedio showed on Windows that the flaw can get around operating system defenses and run arbitrary code on the viewer’s machine. The proof used a stand-in on the host instead of a fully network-based attack. Dar summarized the relationship this way: “The attacker is the host and the victim is the viewer.”

The flaw matters most in industrial settings. Attackers might turn a compromised host such as a human-machine interface — the control panel used to operate machinery — or engineering workstation against a support engineer’s laptop, opening the way to credentials for other systems. That creates a path for lateral movement within industrial control systems.

TeamViewer said it has seen no active exploitation of CVE-2026-111585. CISA’s Known Exploited Vulnerabilities catalog did not list the flaw as of Oct. 29, 2026. That means the agency has not identified active exploitation in the wild.

People using the TeamViewer Host should still move to version 15.83 to patch other high-severity issues affecting that component. TeamViewer’s bulletin for CVE-2026-111585 does not explicitly list the Host, even though version 15.83 fixes the flaw in the Full Client, Portable, and Android app along with the other issues.