TeamViewer flaw could let a malicious host take over a support technician's machine

A high-severity vulnerability in TeamViewer could allow a malicious or compromised host to take over the machine of the person connecting to it, SecurityWeek reports. The flaw flips the usual threat model of remote-support software, where the connecting technician is typically assumed to be the trusted party. TeamViewer has released fixes.

What happened

According to SecurityWeek, the vulnerability is tracked as CVE-2026-111585 and carries a CVSS score of 8.8. Cybersecurity firm Remedio published the research, and TeamViewer issued advisory TV-2026-1011. The report, dated October 30, 2026, says TeamViewer is not aware of any of the disclosed vulnerabilities being exploited in the wild.

Technical details

SecurityWeek describes the issue as an integer overflow in the remote-control screen processing component of TeamViewer clients. When a session starts, the host announces its screen dimensions, and the viewer uses them — without an upper bound — to allocate a pixel buffer for decompressing screen updates. A malicious host can declare a surface large enough to overflow 32-bit arithmetic, causing out-of-bounds writes on the viewer. According to Remedio's research cited by SecurityWeek, this can crash the viewer or lead to arbitrary code execution. The report says exploitation requires a session with an attacker-controlled or compromised host.

Who is affected

The report says the flaw affects TeamViewer clients across Windows, macOS, Linux and Android, naming the Full Client, Host, Portable and the Remote Control App for Android. SecurityWeek also lists related fixes: CVE-2026-92372, an out-of-bounds write in the decoder on macOS and Linux that requires user interaction such as opening a crafted .tvs session recording; CVE-2026-92374, a TOCTOU race condition with improper symbolic link handling on macOS that could let a low-privileged local attacker gain root; and six high-severity local privilege-escalation flaws in the TeamViewer Remote Management add-ons, covered by advisory TV-2026-1012.

What to do

SecurityWeek's main recommendation is to update both the TeamViewer clients and the Remote Management add-ons to the latest versions. Version 15.83 of the clients contains the fixes, and TeamViewer also released updates for multiple legacy versions. While the report lists no workarounds, it notes that because exploitation requires a connection to an attacker-controlled or compromised host, limiting remote sessions to trusted hosts is a sensible precaution. Support organizations whose technicians routinely connect to unknown or customer-controlled endpoints should prioritize the update.