TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.
A malicious or compromised host can exploit the flaw to crash the viewer’s TeamViewer and, depending on the platform, may also run code on the viewer’s computer. This works only after the user starts a remote-control session to that host. The fix is in TeamViewer version 15.83.
The flaw is tracked as CVE-2026-111585 and scored 8.8 out of 10, in the high range. It affects the TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83.
For this flaw, TeamViewer’s bulletin lists the Full Client, Portable, and Android app, but not the Host. The same 15.83 update fixes two other flaws in that bulletin that do affect the Host, so people running the Host should update as well.
Omri Dar, a researcher at security firm Remedio, published a technical account of the flaw on October 29. In this bug, he wrote, “the attacker is the host and the victim is the viewer.”
In a remote session, the host tells the viewer how large its screen image is. The viewer uses that size to set aside memory, but the calculation can overflow and reserve too little. Screen data that arrives afterward is then written past the end of that space.
At a minimum, this crashes the viewer’s TeamViewer session, and the host can trigger the crash again whenever they want.
On Windows, Remedio says it took the bug further, bypassing the operating system’s built-in exploit defenses and running code of its choosing in the viewer. The demonstration used a stand-in on the host to supply part of the attack data, so it is not yet an attack carried out entirely over the network.
That result was shown only on Windows. Whether the same works on macOS, Linux, or Android is not covered in the write-up. TeamViewer only says that code execution is possible, depending on the platform.
The attack needs no password and no extra click beyond accepting the session, and it works in TeamViewer’s default setup, Dar wrote. The flaw affects all versions before 15.83, including 15.82, the security update TeamViewer released in September. Updating last month did not remove it.
What to Do
The only fix TeamViewer offers is to update, and it lists no workaround. Current users should move to 15.83 or later. The fixed builds for older supported branches are in the table above.
The same 15.83 update also fixes two other high-severity flaws in the same bulletin, including a separate code-execution flaw affecting Linux and macOS. A companion bulletin the same day, TV-2026-1012, fixes six more flaws in TeamViewer’s Remote Management add-ons, delivered by automatic update.
TeamViewer said that when it published the fix, it was unaware of any attacks exploiting the flaw. The vulnerability is not in CISA’s Known Exploited Vulnerabilities catalog as of its October 29 listing. Remedio reported no attacks in the wild and did not release exploit code.
