TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

TeamViewer has fixed a high-severity flaw that lets a machine being controlled in a remote session attack the computer that connected to control it. The flaw, tracked as CVE-2026-111585 and scored 8.8 out of 10, affects TeamViewer products before version 15.83. A malicious or compromised host can crash the viewer's TeamViewer session and, depending on the platform, may also run code on the viewer's computer.

How the attack works

In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. Omri Dar, a researcher at security firm Remedio, published a technical account on October 29 and wrote that 'the attacker is the host and the victim is the viewer.' In a remote session, the host tells the viewer how large its screen image is. The viewer uses that size to set aside memory, but the calculation can overflow and reserve too little, so screen data that arrives afterward is written past the end of that space. At a minimum, this crashes the viewer's TeamViewer session, and the host can trigger the crash again whenever they want.

On Windows, Remedio says it took the bug further, bypassing the operating system's built-in exploit defenses and running code of its choosing in the viewer. The demonstration used a stand-in on the host to supply part of the attack data, so it is not yet an attack carried out entirely over the network. That result was shown only on Windows, and whether the same works on macOS, Linux, or Android is not covered in the write-up. TeamViewer only says that code execution is possible, depending on the platform.

Affected products and versions

The flaw affects the TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83. For this flaw, TeamViewer's bulletin lists the Full Client, Portable, and Android app, but not the Host. The same 15.83 update fixes two other flaws in that bulletin that do affect the Host, so people running the Host should update as well. The flaw also affects version 15.82, the security update TeamViewer released in September, so updating last month did not remove it.

What to do

The only fix TeamViewer offers is to update, and it lists no workaround. Current users should move to 15.83 or later. The same 15.83 update also fixes two other high-severity flaws in the same bulletin, including a separate code-execution flaw affecting Linux and macOS. A companion bulletin the same day, TV-2026-1012, fixes six more flaws in TeamViewer's Remote Management add-ons, delivered by automatic update.

TeamViewer said that when it published the fix, it was unaware of any attacks exploiting the flaw. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog as of its October 29 listing. Remedio reported no attacks in the wild and did not release exploit code. The attack needs no password and no extra click beyond accepting the session, and it works in TeamViewer's default setup, Dar wrote.

Sources: The Hacker News