TeamViewer Flaw Allows Controlled Machines to Attack Users
A critical vulnerability in TeamViewer, now patched, allowed compromised host machines to crash viewer clients and potentially execute arbitrary code on the viewer's system.
TeamViewer has addressed a significant security flaw that enabled a compromised host machine to launch attacks against the user controlling it via remote session. The vulnerability, tracked as CVE-2026-111585, carried a CVSS score of 8.8, placing it in the high-severity category. It affected TeamViewer Full Client on Windows, Linux, and macOS, as well as the Windows Portable edition and the Android Remote Control app, in all versions prior to 15.83.
Discovered and detailed by researcher Omri Dar of Remedio, the exploit leverages a flaw in how the host machine communicates its screen size to the viewer. An attacker on the host machine can manipulate this information, causing an integer overflow that leads the viewer to allocate insufficient memory. Subsequent screen data is then written beyond the allocated buffer, resulting in a crash of the viewer's TeamViewer session. This crash could be repeatedly triggered by the attacker.
On Windows systems, the vulnerability was further exploited to bypass operating system defenses and achieve arbitrary code execution on the viewer's machine. While the demonstration required a stand-in on the host to supply attack data, indicating it wasn't a fully remote, network-based exploit at that stage, it highlighted the potential for severe compromise. TeamViewer has stated that code execution is possible on other platforms like macOS, Linux, and Android, depending on their specific configurations, though further details were not provided.
A critical aspect of this vulnerability is that it required no password or additional user interaction beyond accepting the remote session, and it worked with TeamViewer's default settings. This ease of exploitation, combined with the potential for system compromise, made it a significant risk for users relying on remote access for support or operations. The flaw persisted even in TeamViewer version 15.82, which was released just last month.
TeamViewer has released version 15.83 to patch this vulnerability, along with two other high-severity flaws that affect the TeamViewer Host application. Users are strongly advised to update to version 15.83 or later to mitigate these risks. The company has not identified any workarounds for the vulnerability, making an update the sole recommended solution.
In addition to the CVE-2026-111585 flaw, the same 15.83 update also addresses two other critical vulnerabilities affecting the TeamViewer Host. Furthermore, a separate bulletin released on the same day, TV-2026-1012, details six additional vulnerabilities fixed in TeamViewer's Remote Management add-ons, which are updated automatically.
As of the latest advisories, TeamViewer was unaware of any active exploitation of CVE-2026-111585 in the wild, and it has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Remedio also reported no observed attacks and did not release public exploit code, emphasizing the importance of proactive patching.
This incident underscores the inherent risks associated with remote access software. While essential for IT support and remote work, these tools can become vectors for attack if not properly secured. The ability for a controlled system to pivot an attack against the controlling system highlights the need for continuous vigilance and prompt patching of vulnerabilities in such critical infrastructure.