TeamViewer flaw lets controlled hosts attack viewer machines

TeamViewer has released a critical security update to fix a vulnerability that reverses the typical trust model of remote desktop sessions. Discovered by researcher Omri Dar at Remedio, the flaw allows a machine being controlled to attack the computer initiating the connection. The fix is available in version 15.83, released in late October 2026.

What happened

In a standard TeamViewer session, the user who connects to control another machine is called the viewer, while the machine being controlled is the host. This new vulnerability, tracked as CVE-2026-111585, allows a malicious or compromised host to exploit the viewer’s software. The flaw carries a severity score of 8.8 out of 10, placing it in the high-risk category. It affects the TeamViewer Full Client on Windows, Linux, and macOS, as well as the Windows Portable edition and the Android Remote Control app. Any version prior to 15.83 is vulnerable.

The issue was detailed in a technical report published on October 29 by Omri Dar. He noted that the attack requires no password and no additional clicks beyond the user accepting the remote session. It works within the default configuration of the software. Notably, this vulnerability persisted through the previous security update, version 15.82, released in September 2026. Users who updated last month remain exposed unless they install the newer 15.83 build.

While the primary impact is a denial-of-service condition where the viewer’s application crashes, the potential for remote code execution exists. On Windows, researchers demonstrated that the flaw could bypass operating system defenses to run arbitrary code on the viewer’s machine. TeamViewer states that code execution is possible depending on the platform, though the public demonstration was limited to Windows. There are currently no reports of active exploitation in the wild, and the vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog.

How it works

The vulnerability stems from a memory calculation error during the initialization of a remote session. When a viewer connects to a host, the host sends metadata describing the size of its screen image. The viewer’s software uses this information to allocate a specific block of memory to store the incoming visual data. However, the calculation used to determine the required memory size can overflow. This causes the viewer to reserve a buffer that is smaller than necessary.

When the host subsequently sends the actual screen data, the information exceeds the allocated buffer space. This results in a heap buffer overflow, where data is written past the end of the reserved memory region. At a minimum, this corrupts the application state and crashes the TeamViewer client on the viewer’s side. A skilled attacker can manipulate this overflow to overwrite adjacent memory structures. On Windows, this technique was successfully used to hijack the execution flow and run custom code, effectively taking control of the viewer’s system from the host side.

Key details

• Vulnerability ID: CVE-2026-111585 with a CVSS score of 8.8.
• Affected versions: All TeamViewer Full Client, Portable, and Android Remote Control versions before 15.83.
• Attack vector: The host exploits the viewer after a remote session is accepted; no password is required.
• Impact: Denial of service (crash) on all platforms; remote code execution demonstrated on Windows.
• Fix: Update to TeamViewer version 15.83 or later.
• Status: No known active exploitation in the wild as of October 29, 2026.

Why it matters

This flaw is significant because it inverts the expected security boundary of remote access tools. Typically, users worry about unauthorized parties connecting to their machine as a host. Here, the risk comes from connecting to a potentially untrusted or compromised host. For IT teams and support staff who regularly connect to user devices or third-party servers, this creates a supply-chain-like risk where the target environment can weaponize the management tool against the administrator.

For software engineers and security leads, this highlights the dangers of trusting metadata from remote endpoints without rigorous validation. The fact that the calculation overflowed suggests that integer safety checks were insufficient for large or malformed screen size values. It also demonstrates that even with modern operating system protections like ASLR and DEP, memory corruption bugs can still lead to full code execution if the overflow is precise enough. The absence of a workaround means patching is the only mitigation, forcing immediate operational disruption for updates.

What you can do

• Update all TeamViewer installations to version 15.83 or later immediately.
• Verify that the update applied correctly by checking the version number in the Help > About menu.
• Apply the companion update TV-2026-1012 for Remote Management add-ons, which fixes six additional flaws.
• Review logs for any unexpected crashes in TeamViewer clients that may indicate prior exploitation attempts.
• Restrict remote access permissions to trusted hosts only until the patch deployment is complete across your organization.
• Monitor official TeamViewer channels for any further advisories regarding code execution on macOS, Linux, or Android.