TeamViewer Vulnerability CVE-2026-111585: The Flaw That Turns a Support Session Against the Technician, and How to Update

TeamViewer has fixed a flaw that reverses the usual remote support risk. A malicious computer that a technician connects to can crash the technician's own machine, and researchers showed in a lab that it can run code there. If your IT staff or your support provider uses TeamViewer to help customers or employees, every copy used to connect out needs to be on version 15.83 or a fixed legacy build this week.

What happened with the TeamViewer vulnerability

On Tuesday, October 27, 2026, TeamViewer published security bulletin TV-2026-1011, "Security Update for Vulnerabilities in TeamViewer Clients." It covers three flaws in TeamViewer Remote, Tensor and ONE. The headline one is CVE-2026-111585, an integer overflow in the part of the app that processes the remote screen during a remote-control session. TeamViewer rates it 8.8 out of 10 (High) and the bulletin's priority is "Important."

With most remote support risks, people worry about the computer being supported. This one works the other way round. In TeamViewer terms, the host is the computer being controlled and the viewer is the person controlling it, usually a technician. With CVE-2026-111585 the attacker is the host and the victim is the viewer.

The flaw was found by the security firm Remedio. Their timeline says they reported it to TeamViewer on Friday, August 14, 2026. TeamViewer accepted it on Thursday, October 22, and released the fix in version 15.83 on Tuesday, October 27.

How the TeamViewer attack works, in plain English

When a session starts, the host tells the viewer how big its screen is. The viewer uses those numbers to work out how much memory to set aside for the picture. According to Remedio, nothing put an upper limit on the numbers. If a hostile host claims an absurdly large screen, the calculation overflows and wraps around to a small number, so the viewer sets aside far too little memory. Later screen updates then write past the end of that memory, and that kind of mistake can be turned into running the attacker's code.

Remedio says the faulty code path is reachable in TeamViewer's default settings. A hostile host can also force it to be used by refusing the modern video formats (AV1 and H.264), which pushes the viewer onto the older code that has the bug.

What is confirmed and what is claimed

Confirmed by TeamViewer:

• The flaw affects the Full Client (including Portable) on Windows, macOS and Linux before 15.83, the older 15.64, 14.7 and 13.2 lines, and the Remote Control app for Android before 15.83.
• The user must start a remote-control session with the attacker's computer or a compromised one.
• A malicious host can cause a crash and, "depending on the platform," possibly run code with the viewer's privileges.
• TeamViewer says it was not aware of any exploitation in the wild when it published.

Reported by the researchers:

• Remedio says it got code running on a fully updated Windows viewer, version 15.80.6, with Windows' built-in memory protections (CFG and DEP) turned on.
• It says the flawed code was still present in viewer version 15.82.6, the release just before the fix.

Caveats and what is not known:

• Remedio's code execution demo used a tool on the host side in place of a full over-the-network attack, so it is a lab demonstration, not a finished attack tool. No exploit code has been published.
• Nobody has publicly confirmed a reliable real-world exploit, and it is not known whether code execution is practical on macOS, Linux or Android. The crash, on the other hand, is described as something a hostile host can do at will.

The other two TeamViewer flaws in the same update

The same bulletin fixes two more issues:

• CVE-2026-92372 (8.8, High): an out-of-bounds write in the Full Client's screen image decoder on Linux and macOS. It can be triggered by crafted screen data or by a user opening a booby-trapped TeamViewer session recording (a .tvs file).
• CVE-2026-92374 (7.8, High): on macOS, a timing flaw in TeamViewer's privileged helper lets a low-privileged local user install a malicious package and gain root. Affects the Full Client and Host for macOS before 15.83 and the 14.7 and 13.2 lines.

Which TeamViewer versions are fixed

TeamViewer's main advice is to update to 15.83 or the latest release. Use the legacy builds only if your license keeps you on an older line.

What to do this week

1. Find every copy. List each machine that has TeamViewer, including Portable copies sitting in Downloads folders or on USB drives. Portable copies are the easiest to miss because nothing installs them.
2. Update viewers first. Technician and helpdesk machines carry the main risk from CVE-2026-111585. Check the version in the app's About window and confirm it shows 15.83 or later. A version that looks recent, such as 15.82, is still vulnerable.
3. Update hosts too. Hosts on macOS and Linux are covered by the other two fixes, so update unattended machines and servers as well.
4. Update Android. Anyone who supports people from a phone or tablet needs the Remote Control app at 15.83.
5. Be careful who you connect to until you are patched. Treat unexpected "can you connect to my computer?" requests with a TeamViewer ID as suspect, and confirm the request through a phone number or ticket you already have.
6. Do not open outside .tvs recordings on Mac or Linux machines that are not yet updated.
7. Limit what a technician's machine can reach. Because the code would run with the viewer's privileges, run TeamViewer under a standard account, not an administrator one. Keep admin passwords and management consoles away from the machine used to connect to unknown computers, and put support machines on their own network segment where you can. This is our advice, not TeamViewer's.
8. Remove TeamViewer where no one uses it. An unused remote access tool is risk with nothing in return.

Why this matters for a business network

A support technician's computer is often the most valuable machine in the building. It tends to hold saved passwords, VPN access, remote management consoles and admin rights to many other systems. For an IT provider, one technician's laptop can lead into every client they look after.

This flaw gives attackers a simple lure: pose as a customer who needs help, or break into a customer's computer and wait for the support call. The person doing the right thing by helping becomes the way in. We made the same point in Your Tailscale Network Is Only as Safe as Its Weakest Device: one exposed device is only the start if it can reach everything else.

It also matters that the bug survived into 15.82. As we covered in Updated Is Not the Same as Patched, "we keep it fairly current" is not the same as running the fixed build. If no one at your company clearly owns updates for tools like this, Who Is Patching the Software That Runs Your Business? is worth a read.

TeamViewer vulnerability questions people are asking

Is TeamViewer safe to use right now?

Yes, once you are on 15.83 or a fixed legacy build. On older versions, avoid connecting to computers you do not trust.

Is CVE-2026-111585 being exploited?

TeamViewer says it was not aware of any exploitation when it published on October 27, 2026. No exploit code has been released publicly.

Who is at risk, the technician or the customer?

With CVE-2026-111585 it is mainly the technician, meaning whoever connects out and controls the other screen. The macOS and Linux flaws in the same bulletin also affect hosts, so update both sides.

Does the TeamViewer flaw affect Android?

Yes. The Remote Control app for Android before 15.83 is affected by CVE-2026-111585.

What is an integer overflow?

It happens when a calculation produces a number too big for the space it is stored in, so the number wraps around to a much smaller value. Here, that meant the viewer set aside too little memory for the screen image.

How do I check my TeamViewer version?

Open the About TeamViewer window from the app's menu. It should show 15.83 or higher, or one of the legacy build numbers in the table above.

The bigger lesson

Remote support tools are built on trust running one way: the technician is trusted, the customer's machine is not. This flaw shows that trust has to be checked in both directions. The machines your team uses to help others need the same patching, limited privileges and network separation as your servers, because an attacker only needs one support session to get onto them.

Want your remote access tools and support machines locked down properly? See security hardening or get a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: TeamViewer Security Bulletin TV-2026-1011; Remedio: Remote Code Execution in TeamViewer.