TeamViewer Flaw Allows Compromised Hosts to Attack Remote Viewers
A critical vulnerability in TeamViewer enables malicious hosts to execute code on connecting machines.
1Reverse Attack Vector Identified
A critical security flaw, tracked as CVE-2026-111585, reverses the traditional trust model in remote sessions. Typically, the viewer controls the host, but this vulnerability allows a compromised host to attack the viewer. The flaw triggers when a user initiates a remote-control session, exposing the connecting machine to potential exploitation.
2Technical Mechanism of Failure
The vulnerability stems from how the viewer processes screen size data provided by the host. An integer overflow occurs during memory allocation, causing the viewer to reserve insufficient space. Subsequent screen data writes exceed these boundaries, leading to a crash or, on Windows platforms, potential arbitrary code execution by the host.
3Scope of Affected Platforms
The flaw impacts the TeamViewer Full Client on Windows, Linux, and macOS, alongside the Windows Portable edition and the Android Remote Control app. All versions released prior to 15.83 are vulnerable. Notably, the TeamViewer Host software is not explicitly listed in the primary bulletin, though updates are still highly recommended.
4Severity and Exploitation Potential
With a CVSS score of 8.8, this high-severity bug requires no password or additional user interaction beyond accepting the session. Remedio researcher Omri Dar demonstrated that on Windows, the attack can bypass built-in operating system defenses. While the demonstration required specific data inputs, the potential for unauthorized code execution remains significant.
5Update Requirements and Limitations
Users must update to version 15.83 or later to mitigate the risk, as no alternative workarounds exist. Previous updates, such as the September release of version 15.82, do not contain the necessary patches. Organizations must ensure all clients, including portable and mobile versions, are updated to maintain a secure remote environment.
6Broader Security Bulletin Context
The 15.83 update addresses more than just this specific memory overflow. It includes patches for two additional high-severity flaws, one of which involves code execution on Linux and macOS. Furthermore, a companion bulletin, TV-2026-1012, resolves six separate vulnerabilities within TeamViewer’s Remote Management add-ons, which are deployed via automatic background updates.
7Current Threat Landscape Status
As of the October 29 disclosure, TeamViewer reported no evidence of active exploitation in the wild. The vulnerability is currently absent from the CISA Known Exploited Vulnerabilities catalog. Remedio has not released public exploit code, providing a window for administrators to patch systems before potential attackers develop functional, automated exploit scripts.
8Strategic Security Implications
This incident highlights the inherent risks in remote management software, where the host-viewer relationship is a critical trust boundary. Security teams must prioritize patching remote access tools, as they represent high-value targets for lateral movement. Continuous monitoring of identity visibility and attack surface readiness remains essential for mitigating such complex, platform-dependent vulnerabilities.