TeamViewer Vulnerability CVE-2026-111585: How a Hacked Remote Computer Can Attack the Technician, and the 15.83 Fix

A flaw in TeamViewer lets a hacked or hostile computer turn on the person who connects to it. When a technician opens a remote-control session, the computer on the other end can crash TeamViewer on the technician's machine and, depending on the platform, may be able to run code there. If your IT staff or your outside support provider uses TeamViewer to fix other people's computers, updating to version 15.83 belongs on this week's list.

What happened with the TeamViewer vulnerability

On Tuesday, October 27, 2026, TeamViewer published security bulletin TV-2026-1011. It is rated "Important" and covers three flaws in TeamViewer Remote, TeamViewer Tensor and TeamViewer ONE. The one getting attention is CVE-2026-111585, an integer overflow in the part of TeamViewer that processes the remote screen during a remote-control session. The bulletin was updated on Wednesday, October 28.

TeamViewer's own description says the flaw may allow a malicious remote host to cause a denial of service or, depending on the platform, possibly execute code with the privileges of the viewer.

In plain terms, the risk runs the opposite way from what most people worry about. The usual fear is someone remoting into your computer. Here the danger sits with the person doing the remoting, and the attacker is the machine being supported.

The flaw is scored 8.8 out of 10 (High). The CVE record credits Omri Dar as the finder. Dar is lead vulnerability researcher at the security firm Remedio, which published a technical write-up on Thursday, October 29.

What is confirmed and what is not

Confirmed by TeamViewer's bulletin and the CVE record:

• CVE-2026-111585 affects the TeamViewer Full Client, including the Portable version, on Windows, Linux and macOS before 15.83, and the Android Remote Control app before 15.83.
• Older supported branches are affected too: 15.64 (for Windows 7 and 8), 14.7 and 13.2.
• An attack only works if the user starts a remote-control session to a host the attacker controls or has compromised.
• The fix is to update. TeamViewer lists no workaround.
• TeamViewer says it was not aware of active exploitation when it published the bulletin.

Reported by the researcher (Remedio):

• The host tells the viewer how big its screen is. The viewer uses those numbers to size a block of memory, but the math is done with 32-bit arithmetic that can wrap around, so the memory reserved is far smaller than the viewer believes. Incoming screen data is then written past the end of it.
• A hostile host can crash the viewer on a standard Windows install.
• On Windows, Remedio says it went further and ran attacker-chosen code on the viewer machine, getting past the Windows protections Control Flow Guard and DEP, on a fully updated client with default settings.
• Remedio says it confirmed in its lab that the malicious screen dimensions can be sent in an ordinary session. For the code-execution demo, the bytes that corrupt memory were placed by a hook on the host side, which Remedio describes as standing in for the screen data that would normally travel over the connection.
• Remedio tested Windows builds 15.80.6.0 and 15.82.6.0 and found the vulnerable code in both.

Not known:

• Whether anyone has used this against real technicians. Neither TeamViewer nor Remedio reports any attacks.
• How far the code-execution risk goes on Linux, macOS and Android. TeamViewer says "depending on the platform," and Remedio's write-up covers Windows only.
• Whether Remedio plans to release exploit code. Its write-up does not say.

Remedio's timeline: reported to TeamViewer on Friday, August 14, 2026; accepted and published as a CVE on Thursday, October 22; fixed in 15.83 on Tuesday, October 27.

The other two TeamViewer flaws in the same update

The same bulletin fixes two more issues, and these affect the TeamViewer Host as well:

• CVE-2026-92372 (8.8, High): a memory write flaw in the screen-image decoder of TeamViewer for Linux and macOS. Crafted screen-image data can run code, and TeamViewer says it can also be triggered by getting someone to open a crafted TeamViewer session recording (a .tvs file). It affects Full Client and Host before 15.83 on Linux and macOS, plus legacy 14.7 and 13.2.
• CVE-2026-92374 (7.8, High): on macOS, a race condition in TeamViewer's privileged helper lets a local user with low privileges install a malicious package and gain root. It affects Full Client and Host for macOS before 15.83, plus legacy 14.7 and 13.2.

So even though the headline flaw is about the viewer, Host installs on your computers and servers need the update too.

Why the TeamViewer flaw matters for a company network

A support technician's computer is one of the most valuable machines in any organization. It often holds saved connections to many computers, a password manager, admin consoles and VPN access. And technicians connect to a machine because something is wrong with it, which is exactly when it may already be infected. An attacker who controls one PC can simply wait for support to show up.

For a managed service provider, one compromised customer computer could become a path to the technician and, from there, to other customers. For in-house IT, a single infected employee laptop could be used to reach the help desk, which usually has more access than anyone else.

The requirement that the technician start the session is real but thin protection. Starting sessions with troubled computers is the job.

What to do this week

Checklist:

• Update technician and help desk machines first, since they are the target of CVE-2026-111585.
• Find every copy. The Portable version runs without installing and may not appear in software inventory. Check download folders, USB drives and shared tool folders.
• Check the version number in TeamViewer's About screen against the table above.
• Update the Host on employee computers and servers, especially Linux and Mac machines.
• Until Linux and Mac machines are updated, do not open TeamViewer session recordings (.tvs files) from anyone you do not trust.
• Have technicians run TeamViewer from a standard user account, not an administrator account. TeamViewer says code would run with the viewer's privileges, so fewer privileges means less damage.
• Treat a TeamViewer crash during a session with a suspicious computer as a warning sign. Note which machine it was and have the technician's workstation checked.
• If an outside provider supports your business, ask them whether their technicians are on 15.83 and when they updated.

If you run your own servers and remote access, our self-hosting infrastructure page explains how we approach keeping that software patched.

TeamViewer vulnerability questions people are asking

What is CVE-2026-111585?

It is an integer overflow in how TeamViewer handles the remote screen during a remote-control session. A malicious host can crash the viewer and, depending on the platform, may run code on the viewer's computer. It is rated 8.8, High.

Which TeamViewer version fixes the vulnerability?

Version 15.83 or later. Older branches have their own fixed builds: 15.64.10, 14.7.48868, and for 13.2, build 13.2.36231 on Windows, 13.2.154008 on Linux and 13.2.154007 on macOS.

Can hackers get into my computer through this TeamViewer flaw?

Not in the usual direction. CVE-2026-111585 is an attack by the computer being controlled against the person controlling it. The two other flaws in the same update do affect Linux and Mac computers, so update every copy anyway.

Is the TeamViewer flaw being exploited?

TeamViewer says it was not aware of attacks in the wild when it published the fix, and Remedio does not report any. That can change, so do not wait.

Do I need to update the TeamViewer Host?

Yes. The Host is not listed for CVE-2026-111585, but the same update fixes the other two flaws, which do affect the Host on Linux and macOS.

Is there a workaround if I cannot update TeamViewer yet?

TeamViewer lists none. Until you update, avoid sessions with computers you suspect are compromised, and run TeamViewer from a standard user account.

The bigger lesson

Remote support tools trust the other end of the connection, and the other end is often a machine that is already broken or infected. The software that touches the most computers in your business deserves the fastest patching and the least privilege, and your technicians' workstations deserve the same care as your servers.

Want help locking down remote access? See security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: TeamViewer Security Bulletin TV-2026-1011; Remedio: Remote Code Execution in TeamViewer; CVE-2026-111585 record, CVE Program.