TeamViewer CVE-2026-111585: A Malicious Host Can Run Code on the Viewer. Update to 15.83

On 27 October 2026, TeamViewer published security bulletin TV-2026-1011, fixing three flaws in its clients. The most broadly relevant is CVE-2026-111585, an integer overflow in the code that processes the remote screen during a remote-control session. TeamViewer says it "may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process." It affects the Full Client and Portable on Windows, Linux and macOS, and the Remote Control app on Android, before version 15.83. TeamViewer, the CVE Numbering Authority (CNA) for its products, scores it CVSS 3.1 8.8 High.

The twist is the direction of the attack. The usual worry with remote-support tools is a hostile session against the person being helped. Here the victim is the one doing the helping: per the vendor, "exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host." That puts IT helpdesks, managed service providers (MSPs) and vendor support teams, who connect into many outside machines every day, at the centre of the risk. TeamViewer says it was "not aware of any active exploitation in the wild" at publication, and as of 31 October 2026, 09:15 Cyprus time (UTC+2), CVE-2026-111585 and its two sister CVEs are not in CISA's Known Exploited Vulnerabilities (KEV) catalog. There is no workaround; updating is the fix.

Technical Information

What goes wrong. In a TeamViewer session the host shares its screen and the viewer displays it. The CVE record titles the flaw "Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow" (CWE-190) (CVE record). France's health-sector CERT summarises it the same way: an integer overflow during decompression of screen data causes a heap buffer overflow, triggered by crafted screen data from a host the attacker controls or has compromised (CERT Santé).

What the researcher found. The flaw was reported by Omri Dar of Remedio, who is credited in the CVE record. According to Remedio's write-up, the host tells the viewer the width, height and colour depth of its screen at the start of a session, and the viewer uses those numbers, with no upper limit, to size an in-memory buffer for incoming screen updates. The size is calculated in 32-bit arithmetic, so very large dimensions wrap around and produce a buffer far smaller than the screen the viewer thinks it has. Later checks compare each update against the declared dimensions, not against the real buffer, so the host can write past the end of it. Remedio says this decode path is used when no hardware video decoder is negotiated, and that a hostile host can refuse video codecs to force it. Remedio says the crash is easy and repeatable, and that on Windows it went further: it bypassed Control Flow Guard and DEP and ran a program of its choosing on a fully updated viewer. It notes that in its demonstration one step, heap grooming, used a host-side hook in place of the network payload. TeamViewer itself describes code execution as "potentially" possible "depending on the platform".

Scoring. The vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. "User interaction: required" reflects that the victim has to open a session to the hostile host. Any code would run with the rights of the viewer process, that is, the logged-in technician's account. NVD lists the record as "Awaiting Analysis" with no score of its own (NVD).

The two sister flaws in the same bulletin.

Sources: TV-2026-1011; CVE records CVE-2026-92372 and CVE-2026-92374.

Exploitation status. TeamViewer says it was not aware of active exploitation at publication. CERT Santé lists the flaw as not actively exploited, with no public proof of concept. Remedio's write-up describes the technique in detail; we did not seek or open any exploit code. None of the three CVEs is in KEV (catalog version 2026.10.30, rechecked 31 October 2026, 09:22 Cyprus time).

Timeline (Cyprus time):

• 14 August 2026: Remedio reports the flaw to TeamViewer (per Remedio).
• 29 September: TeamViewer bulletin TV-2026-1010 fixes five other client flaws in 15.82. Remedio says the vulnerable code was still present in 15.82.
• 27 October: TeamViewer publishes TV-2026-1011 and version 15.83. The CVE record is published at 17:19 and reaches NVD at 18:17.
• 28 October: TeamViewer updates the bulletin. CERT Santé and the Canadian Centre for Cyber Security (AV26-1093) publish alerts.
• 29 October: Remedio publishes its technical write-up.

Affected Product Versions

Per TV-2026-1011 and the CVE record, for CVE-2026-111585:

Notes:

• 15.82 is not enough. Teams that updated to 15.82 after TeamViewer's September bulletin are still affected by CVE-2026-111585.
• Host also has an update. TeamViewer Host is not listed as affected by CVE-2026-111585, but the bulletin ships Host 15.83 and legacy Host builds, and Host for macOS is affected by CVE-2026-92374. Update Host too.
• Look for Portable. TeamViewer Portable runs without installation, so it is easy to miss in software inventories and patch tools. (Rescana guidance)
• Exposure is not compromise. A vulnerable viewer is only at risk when it connects to a hostile or compromised host.

Workaround and Mitigation

1. Update every viewer. Move the Full Client, Portable and the Android Remote Control app to 15.83 or later, or to the fixed legacy builds above. TeamViewer lists no workaround and "strongly recommends that all users update to the latest available version as soon as possible."

2. Start with support staff. Prioritise helpdesk, IT operations and MSP technicians, and anyone who regularly connects to machines outside your control. (Rescana guidance)

3. Be wary of unexpected "please connect to me" requests. Until every viewer is updated, treat inbound requests to connect to an unknown TeamViewer ID as a possible lure, and confirm the requester through another channel. (Rescana guidance)

4. Limit what a viewer machine can reach. A technician's workstation often holds saved credentials and access to other customers. Keeping privileged credentials off that machine, and using separate accounts for support work, reduces what an attacker gains if a viewer is compromised. (Rescana guidance)

5. Update Linux and macOS clients for the sister flaws. Do not open TeamViewer session recordings (.tvs) from untrusted sources on unpatched Linux or macOS clients (CVE-2026-92372). (Rescana guidance based on the bulletin)

Indicators of Compromise

TeamViewer, NVD and the CERTs we checked have published no indicators of compromise, and none of them maps the flaw to MITRE ATT&CK. Defenders can watch for repeated TeamViewer crashes on support machines during sessions, unexpected programs started by the TeamViewer process on a viewer machine, and sessions from support staff to first-seen TeamViewer IDs. These are hunting ideas, not confirmed signs of attack. (Rescana guidance)

What we will update

We will update this post if CISA adds any of the three CVEs to the KEV catalog, if TeamViewer or a national CERT reports exploitation, if NVD publishes its own score, or if TeamViewer revises the bulletin.

Sources

• TeamViewer: Security bulletin TV-2026-1011, "Security Update for Vulnerabilities in TeamViewer Clients" (issued 27 October 2026, updated 28 October): https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/tv-2026-1011/; security bulletins list (TV-2026-1010, TV-2026-1012): https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/
• CVE records (TeamViewer as CNA): CVE-2026-111585, CVE-2026-92372, CVE-2026-92374
• NVD: CVE-2026-111585, CVE-2026-92372, CVE-2026-92374 (all Awaiting Analysis)
• CISA: CVE-2026-111585, CVE-2026-92372 and CVE-2026-92374 are not in KEV (catalog version 2026.10.30, checked 31 October 2026, 09:15 Cyprus time): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CERT Santé (France): "TeamViewer - CVE-2026-111585" (28 October 2026): https://cyberveille.esante.gouv.fr/alertes/teamviewer-cve-2026-111585-2026-10-28
• Canadian Centre for Cyber Security: TeamViewer security advisory AV26-1093 (28 October 2026): https://www.cyber.gc.ca/en/alerts-advisories/teamviewer-security-advisory-av26-1093
• Remedio: "Remote Code Execution in TeamViewer", Omri Dar (29 October 2026), the researcher's own account: https://remedio.io/research/vulnerability-disclosures/remote-code-execution-in-teamviewer/
• SecurityWeek: "TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians' Machines" (30 October 2026), which drew our attention to the research; facts above were checked against TeamViewer, the CVE record and Remedio: https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/

Many of your suppliers support you, or their own customers, over TeamViewer. This flaw means a single compromised machine on the other end of one of those sessions could reach the technician's workstation, and from there the access that technician holds, possibly including access to your environment. A supplier that can quickly say which TeamViewer versions its support staff run is showing that it knows its own tools.

Forward this to your TPRM owner: Send suppliers that provide remote support, managed IT or helpdesk services a short, friendly check (Rescana guidance):

• Do your support staff use TeamViewer, including Portable or the Android app? Are all viewers on 15.83 or a fixed legacy build?
• Do your software inventory and patch tools cover TeamViewer Portable?
• Are technician workstations kept apart from stored credentials for customer environments?
• How do you verify a request to connect to an unfamiliar TeamViewer ID?

Want a fast, evidence-based view of how your suppliers handle remote-access tool fixes like this one? Book a demo.