If you use TeamViewer to connect to other computers, you need to update right now, because a critical flaw in the remote desktop software lets the machine being controlled attack the computer that connected to control it.
That flips the entire security model on its head. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. The flaw means a malicious or compromised host can crash the viewer's TeamViewer and, depending on the platform, may also run code on the viewer's computer.
The vulnerability is tracked as CVE-2026-111585, it carries a CVSS score of 8.8, and the fix is in TeamViewer version 15.83. If you updated to 15.82 in September, you are still vulnerable.
The Technical Breakdown
Omri Dar, a researcher at security firm Remedio, published a technical account of the flaw on October 29. In this bug, he wrote, "the attacker is the host and the victim is the viewer."
Here is what happens. In a remote session, the host tells the viewer how large its screen image is. The viewer uses that size to set aside memory, but the calculation can overflow and reserve too little. Screen data that arrives afterward is then written past the end of that space.
At a minimum, this crashes the viewer's TeamViewer session, and the host can trigger the crash again whenever they want.
The Code Execution Risk
On Windows, Remedio says it took the bug further, bypassing the operating system's built-in exploit defenses and running code of its choosing in the viewer. The demonstration used a stand-in on the host to supply part of the attack data, so it is not yet an attack carried out entirely over the network.
That result was shown only on Windows. Whether the same works on macOS, Linux, or Android is not covered in the write-up. TeamViewer only says that code execution is possible, depending on the platform.
The attack needs no password and no extra click beyond accepting the session, and it works in TeamViewer's default setup, Dar wrote. That is a terrifying sentence for anyone who relies on TeamViewer for remote support.
Who Is Affected
The flaw affects the TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83.
|
Product |
Affected Versions |
Fixed Version |
|
TeamViewer Full Client (Windows, Linux, macOS) |
All versions before 15.83 |
15.83 |
|
TeamViewer Portable (Windows) |
All versions before 15.83 |
15.83 |
|
TeamViewer Remote Control (Android) |
All versions before 15.83 |
15.83 |
|
TeamViewer Host |
Affected by two other flaws fixed in 15.83 |
15.83 |
For this specific flaw, TeamViewer's bulletin lists the Full Client, Portable, and Android app, but not the Host. However, the same 15.83 update fixes two other flaws in that bulletin that do affect the Host, so people running the Host should update as well.
What to Do Right Now
The only fix TeamViewer offers is to update, and it lists no workaround. Current users should move to 15.83 or later.
The same 15.83 update also fixes two other high-severity flaws in the same bulletin, including a separate code-execution flaw affecting Linux and macOS. A companion bulletin the same day, TV-2026-1012, fixes six more flaws in TeamViewer's Remote Management add-ons, delivered by automatic update.
TeamViewer said that when it published the fix, it was unaware of any attacks exploiting the flaw. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog as of its October 29 listing. Remedio reported no attacks in the wild and did not release exploit code.
FAQ
What is CVE-2026-111585?
It is a high-severity memory corruption flaw in TeamViewer. A malicious host can send a crafted screen size to the viewer, causing an integer overflow, which crashes the viewer's TeamViewer or, on Windows, may allow code execution.
Can a host really hack the viewer?
Yes. The flaw flips the usual attack direction. The machine being controlled (the host) can attack the computer that connected to control it (the viewer) during a remote session.
Do I need a password to trigger the attack?
No. The attack needs no password and no extra click beyond accepting the session. It works in TeamViewer's default setup.
I updated to 15.82 in September. Am I safe?
No. The 15.82 update did not remove this flaw. You need to be on 15.83 or later.
Has this been exploited in the wild?
No. TeamViewer said it was unaware of any attacks when it published the fix, and Remedio reported no attacks and did not release exploit code. The vulnerability is not in CISA's KEV catalog.
