# TeamViewer Flaw Allows Compromised Hosts to Attack Remote Viewers A critical vulnerability in TeamViewer enables malicious hosts to execute code on connecting machines. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-30 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/abca6006-9971-481f-8198-13f45c722af5 ## Reverse Attack Vector Identified A critical security flaw, tracked as CVE-2026-111585, reverses the traditional trust model in remote sessions. Typically, the viewer controls the host, but this vulnerability allows a compromised host to attack the viewer. The flaw triggers when a user initiates a remote-control session, exposing the connecting machine to potential exploitation. ## Technical Mechanism of Failure The vulnerability stems from how the viewer processes screen size data provided by the host. An integer overflow occurs during memory allocation, causing the viewer to reserve insufficient space. Subsequent screen data writes exceed these boundaries, leading to a crash or, on Windows platforms, potential arbitrary code execution by the host. ## Scope of Affected Platforms The flaw impacts the TeamViewer Full Client on Windows, Linux, and macOS, alongside the Windows Portable edition and the Android Remote Control app. All versions released prior to 15.83 are vulnerable. Notably, the TeamViewer Host software is not explicitly listed in the primary bulletin, though updates are still highly recommended. ## Severity and Exploitation Potential With a CVSS score of 8.8, this high-severity bug requires no password or additional user interaction beyond accepting the session. Remedio researcher Omri Dar demonstrated that on Windows, the attack can bypass built-in operating system defenses. While the demonstration required specific data inputs, the potential for unauthorized code execution remains significant. ## Update Requirements and Limitations Users must update to version 15.83 or later to mitigate the risk, as no alternative workarounds exist. Previous updates, such as the September release of version 15.82, do not contain the necessary patches. Organizations must ensure all clients, including portable and mobile versions, are updated to maintain a secure remote environment. ## Broader Security Bulletin Context The 15.83 update addresses more than just this specific memory overflow. It includes patches for two additional high-severity flaws, one of which involves code execution on Linux and macOS. Furthermore, a companion bulletin, TV-2026-1012, resolves six separate vulnerabilities within TeamViewer’s Remote Management add-ons, which are deployed via automatic background updates. ## Current Threat Landscape Status As of the October 29 disclosure, TeamViewer reported no evidence of active exploitation in the wild. The vulnerability is currently absent from the CISA Known Exploited Vulnerabilities catalog. Remedio has not released public exploit code, providing a window for administrators to patch systems before potential attackers develop functional, automated exploit scripts. ## Strategic Security Implications This incident highlights the inherent risks in remote management software, where the host-viewer relationship is a critical trust boundary. Security teams must prioritize patching remote access tools, as they represent high-value targets for lateral movement. Continuous monitoring of identity visibility and attack surface readiness remains essential for mitigating such complex, platform-dependent vulnerabilities. ## Sources covering this story - https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._