TeamViewer has fixed a bug that turns the usual remote-support setup upside down. If a technician connects to a machine that is hostile or already compromised, that machine can send crafted screen data back and crash the technician’s TeamViewer, and on some platforms potentially run code on their computer. The fix is in version 15.83, released on 27 October.
The flaw is tracked as CVE-2026-111585 and carries a CVSS score of 8.8, which TeamViewer rates High. Anyone who does IT support, or helps relatives with their laptops over TeamViewer, should be on the fixed build before the next session.
One multiplication that wraps around
Security firm Remedio, whose researcher Omri Dar found the bug, published a technical write-up on 29 October. The attacker plays the host, and the host announces its screen width, height and colour depth when a session opens. TeamViewer multiplies those figures in 32-bit arithmetic to size a buffer, so absurd values wrap the result down to something tiny. Later checks compare incoming pixel data with the announced screen size instead of the real buffer, and the surplus overwrites neighbouring memory.
Remedio’s test case is a screen of 32,768 by 32,768 pixels at 32 bits per pixel, which would call for more than 4.29 billion bytes. The wrapped sum leaves about four megabytes. The path is reachable because a host can decline the AV1 and H.264 video codecs and leave the viewer with bitmap updates.
Crashing the viewer is easy and repeatable. Remedio says it got a program of its choosing running on Windows despite Control Flow Guard and Data Execution Prevention. That was a lab demonstration, and the firm notes that a stand-in on the host side supplied the bytes that corrupt memory, so it was not a finished network attack.
What TeamViewer’s bulletin covers
TeamViewer’s bulletin TV-2026-1011 lists the Full Client, the Portable build and the Remote Control app on Android before 15.83 for this CVE, across Windows, Linux and macOS. Exploitation needs the user to start a session with an attacker-controlled or compromised host, and code would run only with the privileges of the viewer process.
The same bulletin fixes two other bugs. CVE-2026-92372 is a memory-write bug in the Linux and macOS screen decoder, reachable through a remote session and also by opening a booby-trapped .tvs recording. CVE-2026-92374 affects the macOS helper and lets a low-privileged local user reach root by slipping a malicious package past installer checks. TeamViewer’s advice for all three is to install 15.83 or whatever is newest. Legacy installs have their own patched builds, named in the same bulletin.
Updating before connecting to a machine you don’t control is the safest habit, since accepting the session is all the attack needs.
