TeamViewer patches CVE-2026-111585: a malicious host can hit the viewer
An integer overflow in the TeamViewer viewer lets a malicious or compromised host crash the session or run code on the controller's machine. Fixed in 15.83; update now.
TeamViewer has patched a high-severity flaw that inverts the usual trust direction of a remote session: the host can attack the viewer. CVE-2026-111585, scored CVSS 8.8, is an integer overflow in the viewer's screen-rendering path. A malicious or compromised remote machine can crash the controller's TeamViewer session and, depending on platform, run code in the viewer process. The fix is in 15.83. If you ever connect out to machines you don't fully control — support desks, MSPs, anyone remoting into customer endpoints — this is a patch-now item.
What the bug does
Per TeamViewer's bulletin TV-2026-1011, the root cause is an integer overflow in how the viewer sizes the memory buffer for the host's screen image. The overflow yields a buffer too small for the incoming frame data, and later screen bytes are written past its end. The attacker is the host; the victim is the viewer who started the remote-control session. No password prompt, extra click, or non-default configuration is required beyond accepting the session.
The outcome is a denial of service at minimum. On Windows, researcher Omri Dar of Remedio demonstrated bypassing built-in exploit defenses to achieve code execution in the viewer process. That proof-of-concept used a stand-in on the host to supply part of the attack data, so Remedio stops short of calling it a fully network-only attack; code execution on Linux and macOS is not covered in the write-up.
Affected versions
- TeamViewer Full Client on Windows, Linux, and macOS
- TeamViewer Windows Portable
- TeamViewer Android Remote Control app
- All builds before 15.83. Version 15.82, released in September, did not fix it.
Fixed builds also exist for the older supported branches (the 13.2, 14.7, and 15.64 maintenance lines are listed in the bulletin). Host users should update too: the same release closes two other Host-affecting flaws.
Exploitation status
No in-the-wild exploitation. TeamViewer said it was unaware of any at publication, and the CVE was not in CISA's Known Exploited Vulnerabilities catalog as of its October 29 listing. Remedio published its technical account on October 29 and did not release exploit code.
Action checklist
- Update every TeamViewer install to 15.83 or later — including the Android app and any Portable copies, which don't auto-update and tend to linger on USB sticks and jump boxes.
- Prioritize machines used to remote out to untrusted or customer endpoints; those are the viewers this bug targets.
- Pin your legacy branches to the fixed 13.2/14.7/15.64 builds if you can't move to the 15.83 train yet.
- There is no workaround — the only mitigation is the patch, so schedule it rather than deferring.
Context
Remote-access tooling is a standing target, but the usual threat model assumes the controller is the trusted party and the remote endpoint is what's at risk. CVE-2026-111585 flips that: compromise one endpoint that support staff connect into, and you get a shot at the far more privileged technician's workstation. For MSPs and help desks that touch hundreds of machines a day, the viewer is the crown jewel — treat it as the asset under attack, not the safe end of the connection.