// AI threat desk · 2 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighCVECVSS 8.8

TeamViewer flaw could let remote hosts crash viewer, possibly run code

A TeamViewer flaw could let a malicious remote host crash the viewer and potentially run code on a technician’s machine. Remedio researcher Omri Dar disclosed the findings on Oct 29.

· 2 min read
AI-generated image of a technician viewing a remote-support session in a dim security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • A malicious remote host could crash the TeamViewer viewer and potentially run code on the technician’s machine.
  • Exploitation requires the victim to establish a remote session with an attacker-controlled or compromised host.
  • TeamViewer released a fix in version 15.83 on Oct 27.

TeamViewer has fixed a vulnerability that could let a malicious remote host turn a support session against the technician providing help. Remedio researcher Omri Dar published the technical findings on Oct 29, after TeamViewer released a fix on Oct 27.

The attack requires the victim to establish a remote session with an attacker-controlled or compromised host. The host can then send crafted screen data through the support connection, crashing the viewer and potentially running code on the technician’s machine.

TeamViewer is remote-access and remote-control software used to maintain computers and other devices. The vulnerability affects TeamViewer clients before version 15.83, and TeamViewer said it was not aware of attacks exploiting the flaw when it published the fix.

On this page

The host can force vulnerable screen processing

Remedio said the viewer allocates an in-memory pixel buffer using screen dimensions supplied by the host. SecurityWeek said a host can refuse video codecs and force the viewer onto the vulnerable bitmap-processing path.

Remedio gave an example using a 32768-by-32768-pixel screen at 32 bits per pixel. The calculation overflows 32 bits, with every row past 31 written out of bounds.

SecurityWeek described the issue as an integer overflow in TeamViewer’s remote-control screen processing component. TeamViewer said it could cause denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process.

The affected clients include desktop and Android editions

The Hacker News said the affected products are TeamViewer Full Client on Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83.

The Hacker News said the demonstration used a host-side stand-in for part of the attack data, so it was not entirely network-based.

Remedio reported the issue to TeamViewer Product Security on Aug 14, 2026. TeamViewer accepted the finding as High with a CVSS score of 8.8 on Oct 22 and published it as CVE-2026-111585.

TeamViewer’s bulletin said it was not aware of active exploitation in the wild when published. The 15.83 release also addresses two other flaws affecting the Host, according to The Hacker News.

What to do now

  1. Update to the latest version, 15.83 or the latest version available.
  2. If you run the TeamViewer Host, update because the same 15.83 update fixes two other flaws that affect the Host.

FAQ

What happened to TeamViewer?

A vulnerability could let a malicious remote host crash the viewer and potentially run code on the technician’s machine during a support session.

Who is affected by CVE-2026-111585?

The Hacker News said the flaw affects TeamViewer Full Client on Windows, Linux and macOS, Windows Portable, and the Android Remote Control app before version 15.83.

Has the TeamViewer flaw been exploited?

TeamViewer said it was unaware of attacks exploiting the flaw when it published the fix, and its bulletin said it was not aware of active exploitation in the wild when published.

How do I fix CVE-2026-111585?

TeamViewer released version 15.83 and recommends updating to version 15.83 or the latest available version.

How does the TeamViewer attack work?

The victim must establish a remote session with an attacker-controlled or compromised host. The host then sends crafted screen data through the same connection, targeting the viewer’s screen-processing component.

Sources

  1. TeamViewer Security Flaw Could Turn Remote Support Sessions Into Computer Takeovers, HKCERTPrimary
  2. TeamViewer RCE Vulnerability (CVE-2026-111585) | Remedio, RemedioPrimary
  3. TV-2026-1011, TeamViewerPrimary
  4. TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines, SecurityWeek
  5. TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them, The Hacker News
  6. TeamViewer, Wikipedia
How we checked this story
ClaimSourceStatus
A newly disclosed TeamViewer vulnerability could let an attacker turn a routine remote support session against the technician providing help.HKCERTConfirmed
The flaw can crash the viewer application and potentially run code on the technician’s machine.HKCERTConfirmed
TeamViewer rates the flaw High, with a CVSS score of 8.8.HKCERTConfirmed
Remedio researcher Omri Dar published the technical findings on 29 October after a fix was released on 27 October.HKCERTConfirmed
Exploitation requires the victim to establish a remote session with an attacker-controlled or compromised host.HKCERTConfirmed
The host attacks the viewer by sending crafted screen data through the same connection used for support.HKCERTConfirmed
SecurityWeek said the flaw is an integer overflow affecting TeamViewer’s remote-control screen processing component and has a CVSS score of 8.8.SecurityWeekAttributed
Remedio said the viewer allocates an in-memory pixel buffer using screen dimensions supplied by the host.Remedio, via SecurityWeekAttributed
SecurityWeek said a host can refuse video codecs and force the viewer onto the vulnerable bitmap-processing path.SecurityWeekAttributed
Remedio said for a 32768-by-32768-pixel screen at 32 bits per pixel, the calculation overflows 32 bits and writes rows past 31 out of bounds.Remedio, via SecurityWeekAttributed
The Hacker News said the Windows demonstration used a host-side stand-in for part of the attack data, so it was not entirely network-based.The Hacker NewsAttributed
TeamViewer said it was unaware of attacks exploiting the flaw when it published the fix.TeamViewer, via The Hacker NewsAttributed
The Hacker News said the flaw affects TeamViewer Full Client on Windows, Linux, and macOS, Windows Portable, and the Android Remote Control app before version 15.83.The Hacker NewsAttributed
Remedio reported the issue to TeamViewer Product Security on 14 August 2026.RemedioConfirmed
TeamViewer Product Security accepted the finding at CVSS 8.8 on 22 October 2026, and it was published as CVE-2026-111585.RemedioConfirmed
TeamViewer released the fix in version 15.83 on 27 October 2026.RemedioConfirmed
TeamViewer’s bulletin says it was not aware of active exploitation in the wild when published.TeamViewerConfirmed
The integer-overflow vulnerability can cause denial of service or, depending on the platform, potentially execute arbitrary code with viewer-process privileges.TeamViewerConfirmed
TeamViewer is remote-access and remote-control software used to maintain computers and other devices.WikipediaConfirmed
TeamViewer has been installed on more than 2.5 billion devices.WikipediaConfirmed
HKCERT published its report on Oct 30, 2026.HKCERTConfirmed

Could not verify

  • Whether the demonstrated Windows code execution works entirely over the network is not established.
  • Whether code execution works on macOS, Linux, or Android is not established.
  • How many TeamViewer installations are affected is not established.
  • Whether the flaw has been exploited in the wild is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok