TeamViewer Vulnerability Lets the Machine You Control Attack You

A new TeamViewer vulnerability turns the usual remote support model upside down. Normally the person helping you is the one with the power. Here, the machine being controlled can attack the person doing the controlling. TeamViewer fixed the flaw in version 15.83 on 27 October 2026, and it affects the Full Client on Windows, Linux and macOS, plus the Android Remote Control app.

What the TeamViewer vulnerability does

This TeamViewer vulnerability is tracked as CVE-2026-111585 and scores 8.8 out of 10 on the CVSS scale. It sits in the code that draws the remote screen on the viewer’s side. The remote host tells the viewer how big its screen image is, and the viewer reserves memory based on that. The size calculation can overflow, so the viewer sets aside far too little space. Screen data is then written past the end of it.

Omri Dar, a researcher at Remedio, found the bug and reported it to TeamViewer on 14 August. His write-up puts the cause in one line: “The bug is one multiply done in 32 bits.”

At minimum, a hostile host can crash your session, and it can do so again and again. On Windows, Remedio says it went further and ran code of its choosing on the viewer’s machine, getting past the operating system’s built-in exploit defences. The demonstration was run in a lab, and part of the attack data came from a stand-in on the host rather than the live network. TeamViewer’s own wording is cautious: code execution is possible “depending on the platform”.

Who needs to worry

The attacker has to be the host, and you have to accept the session. So the realistic victims are people who connect out to other machines: IT support staff, managed service providers, and anyone who helps relatives or customers.

That group is bigger than it sounds. A help desk technician who dials into a stranger’s laptop sits on a corporate network with admin tokens, saved passwords and access to internal tools. If an attacker can trick that technician into a session, the technician’s PC becomes the way in.

• Support teams that connect to customer or supplier machines.
• Small firms that use TeamViewer to reach their own staff’s home computers.
• Anyone who accepts “can you take a look at this?” requests from outside the business.

What we know about exploitation

TeamViewer says it knows of no attacks in the wild, and Remedio did not release exploit code. The flaw was not in the US CISA catalogue of known exploited vulnerabilities when this was written. That is reassuring, but it will not last for this TeamViewer vulnerability. Once a patch ships, attackers can compare old and new code and work out the bug themselves. The window between a fix and the first attempts has shrunk to days in recent cases.

There is no workaround. TeamViewer’s bulletin offers one remedy, which is to update. The same release also fixes two other high-severity flaws, including a separate code execution bug in the Linux and macOS screen decoder, so the update is worth doing even if you only use the Host.

What to do this week

Start with an inventory. Many businesses cannot say where TeamViewer is installed, because staff add it themselves. A vulnerability scanning service or a simple software audit will turn up the copies you did not know about.

1. Update every Full Client, Portable copy and Android app to 15.83 or later. Older supported branches have their own fixed builds, listed in TeamViewer’s bulletin.
2. Check that auto-update works. Portable copies often sit on a USB stick or a shared drive and never update.
3. Until you have patched, only start sessions with hosts you trust. Be wary of unfamiliar support requests.
4. Treat an unexplained TeamViewer crash as a possible sign of an attempt, and tell your security contact.

A score of 8.8 does not tell you how urgent this is for your business. Context does. Our guide to prioritising patches by CVSS score explains how to weigh it, and for most firms with a help desk, this one belongs near the top.

The wider lesson

Remote access tools are trusted by design. They bypass firewalls, they run with high privileges, and staff click “accept” on them all day. That makes them a favourite target. This bug is a reminder that trust runs both ways: the software that lets you control a machine also processes whatever that machine sends back.

A scanner will tell you whether the old version is installed. It will not tell you whether a technician’s laptop could be used as a stepping stone. That is a question for hands-on testing, and the difference is covered in our piece on penetration testing versus vulnerability scanning.