Researcher demonstrates remote code execution in TeamViewer for Windows
Researcher Omri Dar demonstrated remote code execution in the TeamViewer Windows client: a malicious host exploits an integer overflow in the video buffer size calculation and writes out of bounds. The victim only needs to connect the viewer to the attacker's host; no further interaction is required, and the demo worked with built-in protections enabled. The source mentions no fix; instruct users not to connect to unknown hosts.
What happened
A researcher demonstrated a flaw in the TeamViewer Windows client that lets a malicious host run code on the victim's computer during a remote-control session. The victim only needs to connect the viewer to the attacker's host; no password theft or further interaction is required. The researcher executed a program of his choice on the vulnerable client, with built-in protections enabled.
Why it matters
Any employee who connects TeamViewer to an attacker-controlled host can have code run on their workstation, even with the product's built-in protections enabled. This opens the door to data theft and machine compromise. The source reports no available fix.
What to do
Instruct users never to connect TeamViewer to unknown or unverified hosts. Monitor TeamViewer sessions for unusual destinations and apply the vendor's fix as soon as one exists.
For the technical team
- Affected
- Cliente TeamViewer para Windows · TeamViewer client for Windows; the source cites no versions.
- Exploitation
- Researcher demonstration: Omri Dar of Remedio, per the dbugs report, achieved execution of a selected program on the vulnerable Windows client with built-in protections enabled. The source reports no in-the-wild exploitation.
- Fix
- The source mentions no fixed version, patch, or mitigation.
- Vector
- TeamViewer client for Windows, during a remote-control session initiated by the victim against the attacker's host. When establishing the session, the host sends a DisplayParams message (screen width, height, and color depth) used to create the CBitmapBuffer; the malicious host refuses to negotiate the AV1/H.264 codecs, forces bitmap decoding, and selects the lossless tile codec. The flaw is an integer overflow: 'stride × (height + 0x10)' is computed in 32-bit arithmetic and only then widened to 64 bits for 'operator new[]'; for a 32768 × 32768-pixel surface at 32 bpp, about 4 MB is allocated instead of the more than 4 GB required. The RLE decoder validates the rectangle against the declared width and height, but not against the memory actually allocated; the update '(0, 0, 32768, 32768)' passes validation and causes an out-of-bounds write. Condition: the victim connects the viewer to the attacker's host; no further interaction.
- More details
- With 'Width = 0xFFFFFFF5', 'Height = 1', and 'BPP = 8', the allocation drops to roughly 0x440 bytes, placing the buffer in a small heap size class next to objects the attacker can groom. Using the overflow, the researchers overwrote a pointer in a live object, bypassed Control Flow Guard and DEP, redirected execution to WinExec, and executed the attacker's code. No CVE or date is cited in the source.
Timeline
First report: researcher demonstrates RCE via buffer overflow in the TeamViewer Windows client.
Sources 1 source
- @ptdbugs @ptdbugs
