TeamViewer has released fixes for a high-severity vulnerability that flips the usual remote support risk model, publishing security bulletin TV-2026-1011 for the flaw tracked as CVE-2026-111585. The issue carries a CVSS score of 8.8 and affects TeamViewer clients on Windows, macOS, Linux and Android. TeamViewer says it is not aware of any of the vulnerabilities in the bulletin being exploited in the wild, and version 15.83 contains the fix.
Security firm Remedio, which reported the issue, describes it as an integer overflow in the remote-control screen processing component of the clients, according to SecurityWeek. Successful exploitation could let attackers crash the viewer’s TeamViewer or execute arbitrary code on the viewer’s system, meaning the IT support technician who connects to a machine is the one exposed. TeamViewer’s advisory notes that exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
Remedio traced the problem to how the host’s screen dimensions are handled. The host announces the geometry of its screen, and the viewer uses the received dimensions to allocate an in-memory pixel buffer for decompressing incoming screen updates. That decoding path is used when a hardware video decoder is not available for the session, and Remedio notes that a host can refuse to negotiate video codecs, steering the viewer onto it. Because no upper bound was enforced on the dimensions arriving over the network, a host could request an oversized surface and cause writes beyond the buffer.
Remedio demonstrated that the flaw could go beyond a crash. The company said it was able to use the issue to run code on the viewer’s system, and that the surface is reachable in the default configuration, so an accepted session is all it takes. That detail matters because accepting sessions is the product’s normal mode of operation.
The fixed version, TeamViewer 15.83, covers the full client, the host, the portable edition and the Remote Control app for Android. TeamViewer also released security updates for multiple legacy versions, so organizations on older release lines have a path to patch without a full version change.
The same round of updates resolves several other issues. The macOS and Linux updates also fix CVE-2026-92372, an out-of-bounds write that could be triggered by crafted screen-image data or by opening a specially crafted TeamViewer session recording, which requires user interaction. On macOS, the updates also address CVE-2026-92374, a race condition involving symbolic link handling that could let a low-privileged local attacker install a malicious package and gain root privileges. TeamViewer also patched six high-severity local privilege escalation vulnerabilities in its Remote Management add-ons and urges users to update both the clients and those components.
The risk model deserves attention because most security advice about remote support focuses on the machine being controlled. A technician connecting to a customer’s computer is normally the trusted party, and the customer is the one taking the chance. This flaw reverses that arrangement. The person who opens the session is the one exposed, and the party able to trigger the problem is the host on the other end. For an IT service provider whose staff connect to dozens of unfamiliar machines in a single shift, that is a meaningful change in exposure, and it explains why the vendor and the researchers treated the report seriously.
The practical guidance is straightforward. Help desks and managed service providers that connect to many customer machines each day are the natural first group to update, since their technicians are the people who open sessions to systems they do not control. Administrators can inventory where TeamViewer clients are installed, move to 15.83 or the matching legacy release, update the Remote Management components, and confirm that automatic update policies are working.
With a fix available and no exploitation reported, defenders have a clear window to close the gap. The disclosure is also a reminder that remote access tools sit on both sides of a trust relationship, and that patching the technician’s workstation matters as much as securing the machines being supported.
Leave a Reply