TeamViewer CVE-2026-111585: malicious host attacks the technician

On 30 October SecurityWeek, heise Security and The Hacker News reported on a vulnerability fixed by TeamViewer that turns the usual remote support model upside down: the computer at risk is not the one being controlled, but the one of the technician who connects. The flaw, CVE-2026-111585 (CVSS 8.8), is an integer overflow in the component that processes the remote screen in the Windows, macOS, Linux and Android clients, and was discovered by security firm Remedio. The technical details that follow come from the SecurityWeek article, which quotes TeamViewer’s advisory and Remedio’s analysis.

The vulnerability

According to TeamViewer’s advisory, exploitation requires a user to open a remote control session to an attacker-controlled or compromised host. The consequences range from a crash of the technician’s program (the viewer) to arbitrary code execution on their system.

The mechanism, as Remedio describes it:

1. when the session opens, the host announces the geometry of its screen;
2. the viewer uses those dimensions as received to allocate the in-memory pixel buffer into which it decompresses screen updates: there is no upper bound on the values arriving over the network;
3. this decode surface is only used when no hardware video decoder is available for the session, but the host can refuse to negotiate video codecs and force the viewer onto it;
4. with dimensions no real screen could have, for example 32,768 × 32,768 pixels at 32 bits per pixel, the size calculation exceeds 32 bits: according to Remedio, every row past the thirty-first is written outside the buffer.

Since the host controls both the declared surface and the updates that fill it, it can make the technician’s program crash over and over. Remedio stresses that an ordinary session is enough, using only messages the protocol already supports.

From crash to code execution

Remedio went beyond denial of service. The corrupted surface is a live object: later on the viewer calls it through a pointer stored in its first field, and overwriting that pointer redirects the call. In their demonstration the researchers bypassed existing protections and routed the call to the Windows function WinExec, running code inside the viewer.

According to Remedio, the vulnerable surface is reachable in the default configuration: an accepted session is all it takes, which is simply how the product normally works.

In MITRE ATT&CK terms, exploitation falls under T1203 (Exploitation for Client Execution); the local flaws fixed in the same round, described below, fall under T1068 (Exploitation for Privilege Escalation).

Fixed versions and other flaws

• CVE-2026-111585: fixed in version 15.83 of the TeamViewer clients (Full Client, Host, Portable and the Remote Control App for Android). TeamViewer has also released security updates for several legacy versions, which SecurityWeek does not list: check the vendor advisory for the branch you use.
• CVE-2026-92372 (macOS and Linux updates): an out-of-bounds write in the decoder, caused by missing destination bounds checks. It can be exploited with crafted screen image data or by convincing the user to open a specially crafted TeamViewer session recording (.tvs); user interaction is required. Here too the outcome can be code execution.
• CVE-2026-92374 (macOS): a TOCTOU race condition with improper symbolic link handling; a low-privileged local attacker can install a malicious package and gain root privileges.
• Six high-severity local privilege escalation vulnerabilities in the TeamViewer Remote Management add-ons; SecurityWeek does not give CVE identifiers. TeamViewer recommends updating both the clients and these components.

TeamViewer says it is not aware of any of these flaws being exploited in the wild. The sources do not report any indicators of compromise.

Impact for European and Italian companies

TeamViewer is widely used by internal help desks, managed service providers and vendors’ technical support teams. The technician’s workstation is usually among the most valuable on the network: from there you reach colleagues’ and customers’ computers, often with credentials and administrative tools close at hand. This flaw makes it possible to hit that workstation from the other end of the connection: from a customer computer that is already compromised, or from a machine set up for the purpose, to which a technician is persuaded to connect, for instance through a fake support request.

For managed service providers this is a supply chain issue, central to NIS2: a compromised support workstation can become the starting point towards other customers’ networks. Healthcare deserves the same attention, since external vendors often support clinical systems and equipment remotely.

What to do now

1. Update every TeamViewer client to 15.83, or to the security release for your legacy branch, starting with the support team’s workstations: they are the ones exposed to CVE-2026-111585.
2. Look for unmanaged copies: Portable versions bypass the usual software distribution systems and easily fall behind.
3. Update the Remote Management components together with the clients, as TeamViewer recommends.
4. Do not rely on hardware decoding as a defence: the host can refuse video codecs and force the vulnerable path.
5. Restrict sessions to unknown hosts until the update is complete: no connections to machines outside your list of known customers or at the request of unverified contacts.
6. On macOS and Linux, do not open .tvs recordings of uncertain origin before updating.
7. Detection: watch for repeated TeamViewer crashes on technicians’ workstations during a session and for unusual child processes started by the TeamViewer program.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package: it helps you find the computers still running a TeamViewer version that needs updating. ARX Sentry collects logs, security events and the software and process inventory of monitored computers, and groups suspicious executions in the SOC pages.

Last updated: 30 October 2026