TeamViewer fixed a flaw in which the computer being controlled in a remote session can attack the computer doing the controlling. Tracked as CVE-2026-111585 and scored 8.8 (high), it is an integer overflow in the part of the client that processes the remote screen. In a session, the host tells the viewer how large its screen image is; the viewer sets aside memory based on that size, but the calculation can overflow and reserve too little, so later screen data is written past the end of the buffer. TeamViewer says this may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially run code with the privileges of the viewer process.
The attack only works after the user starts a remote-control session to an attacker-controlled or compromised host, which TeamViewer says is required. Omri Dar of Remedio, who found the flaw, wrote that it needs no password and no extra click beyond accepting the session, and works in TeamViewer’s default setup. According to The Hacker News, Remedio demonstrated code execution on Windows by bypassing the operating system’s built-in exploit defenses, using a stand-in on the host to supply part of the attack data, so it was not a fully network-delivered attack; whether it works on macOS, Linux or Android is not covered in the write-up. TeamViewer says it was not aware of active exploitation when it published the fix, and Remedio reported no attacks in the wild and did not release exploit code.
How to check if you’re affected
Affected versions are TeamViewer clients prior to 15.83: the Full Client and Portable edition on Windows, Linux and macOS, and the Remote Control app on Android. The listed legacy lines are 15.64 (Windows), 14.7 and 13.2. Updating to September’s 15.82 security release did not remove this flaw.
- Check which TeamViewer version each of your devices runs and update to 15.83 or later. TeamViewer’s bulletin says to update and lists no workaround.
- Older supported branches have their own fixed builds: 15.64.10 (Windows 7 and 8), 14.7.48868 and 13.2.36231 (Windows), with Linux and macOS builds in TeamViewer’s bulletin table.
- The same 15.83 update fixes other flaws in the same bulletin, including a macOS privilege-escalation flaw (CVE-2026-92374) that affects the Host, so people running the Host should update too.
This is a different issue from the one covered earlier: TeamViewer Urges Immediate Patch for Five Severe Flaws.