TeamViewer · Exploitation confirmed

TeamViewer Patches Flaw Letting Attended Machine Seize Technician's PC

Oct 29, 2026 · 2 min read

CVE-2026-111585 (CVSS 8.8) is an integer overflow in TeamViewer's screen processing that lets a malicious or compromised attended machine crash the client or run code on the technician's PC as soon as the session opens, with no click beyond accepting the connection. Remedio demonstrated code execution on a stock Windows client; TeamViewer says it is not aware of exploitation in the wild. Version 15.83 and updates for legacy versions fix the flaw, along with CVE-2026-92372, CVE-2026-92374 and six local privilege escalations in Remote Management add-ons; update clients and add-ons.

By HIFY Radar newsroom Updated 10/30/2026 03:45 PM Get this every day →← Back to the feed 5 sources

HighVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

TeamViewer has fixed a serious flaw (CVSS 8.8) where the computer a technician connects to help can attack the technician's own machine. When the session opens, with no click beyond accepting the connection and no stolen password, the remote machine can crash TeamViewer or run code on the support PC. The fix is already available.

Why it matters

Any support team using TeamViewer is exposed: helping one compromised machine can hand the attacker the technician's PC, often a springboard to privileged access elsewhere. The vendor says the product is installed on more than 2.5 billion devices. TeamViewer says it knows of no real-world attacks abusing the flaw.

What to do

Update every TeamViewer client to version 15.83 or later, including legacy versions, plus the Remote Management add-ons. The company has published no alternative mitigation.

For the technical team

CVE: CVE-2026-11585, CVE-2026-111585
Affected: TeamViewer · TeamViewer clients before 15.83: Full Client (Windows, macOS and Linux), Windows Portable and Android Remote Control App.
Exploitation: No known exploitation in the wild, per TeamViewer. Remedio published a technical writeup and demonstrated code execution on a stock Windows client with default settings and defenses on; the proof required part of the attack data to be supplied locally and was not a fully remote exploit.
Fix: Version 15.83 or later (Full Client, Host, Portable and Android Remote Control App); updates also released for multiple legacy versions. No workaround published.
Vector: Integer overflow in the TeamViewer client's screen buffer sizing (CBitmapBuffer). The attended machine announces malicious geometry (DisplayParams message: width, height and bpp) and refuses video codec negotiation to force the viewer onto the bitmap path; a 32-bit multiply wraps, so the allocation is smaller than the declared surface. Bounds checks use the declared dimensions, not the real allocation, and the RLE decoder writes out of bounds. Condition: the technician establishes a session to an attacker-controlled or compromised host; accepting the session is all it takes, with no stolen password.
More details: Remedio example: 32768 by 32768 pixels at 32 bpp allocates about 4 MB for a surface declared as 32,784 rows; every row past the 31st is written out of bounds. Overwriting the pointer in the corrupted object's first field redirects the call to WinExec, bypassing existing protections. The same updates fix CVE-2026-92372 (out-of-bounds write on macOS and Linux via crafted screen-image data or a specially crafted .tvs session recording; requires user interaction) and CVE-2026-92374 (TOCTOU race condition with improper symbolic link handling on macOS, local escalation to root), plus six high-severity local privilege escalation vulnerabilities in the TeamViewer Remote Management add-ons.

Timeline

10/30/2026 03:45 PM
Technical details disclosed: a manipulated screen-size value triggers an integer overflow that writes outside the allocated buffer in the TeamViewer client, crashing the session and potentially executing code; CVSS 8.8.
10/30/2026 01:44 PM
Coverage details the flaw's mechanics: a malicious controlled machine can crash the controller's TeamViewer and, depending on the platform, run code; the fix is already out.
10/30/2026 12:23 PM
Researcher demonstrates code execution on a stock Windows TeamViewer viewer with default settings and defenses enabled, requiring only that the technician accepts the session.

Want the next updates in your inbox? Get the daily edition →

See all 5 updates

10/30/2026 05:54 AM
SecurityWeek details the flaw as an integer overflow, tracked as CVE-2026-111585, allowing arbitrary code execution on the technician's viewer system.
10/29/2026 12:27 PM
Incident opened.