TeamViewer vulnerability puts remote-session viewers at risk
A TeamViewer vulnerability allows a malicious or compromised remote computer to attack the device used to control it. TeamViewer has corrected the software weakness in version 15.83. All earlier versions are affected, including 15.82, a security update released in September.
The flaw reverses the risk normally associated with a remote-control session. TeamViewer calls the computer initiating the connection and taking control the viewer, while the computer being controlled is the host. After a user accepts a session with a hostile host, that host can crash the viewer's TeamViewer software. Depending on the viewer's operating system, code execution, meaning the ability to run instructions on the affected computer, may also be possible.
The vulnerability has the Common Vulnerabilities and Exposures identifier CVE-2026-111585 and a severity score of 8.8 out of 10, placing it in the high range. It affects TeamViewer Full Client on Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control app in every version before 15.83. Remedio, the security company whose researcher documented the flaw, said the attack works with TeamViewer's default configuration. It requires no password or additional click after the user accepts the remote session.
Remedio published its technical account on October 29. During a session, the host reports the dimensions of its screen image to the viewer. The viewer uses those dimensions to calculate how much memory, the computer's temporary working space, it should reserve for the incoming image. A calculation overflow can produce an incorrect result and cause the viewer to reserve too little space. Subsequent screen information is then written beyond the end of that reserved area.
The immediate result is a crash of the viewer's TeamViewer session. The malicious host can trigger that crash repeatedly whenever the viewer reconnects. This creates a direct availability risk for support staff and IT teams because a computer they are trying to assist can terminate their remote-control software.
Remedio also demonstrated a more serious result on Windows. Its researcher bypassed the operating system's built-in exploit defenses, which are protections intended to make software weaknesses harder to turn into working attacks, and ran chosen code on the viewer. However, the demonstration used a stand-in component on the host to provide part of the attack data, so it did not show an attack conducted entirely across the network. The result was demonstrated only on Windows. Remedio's account did not establish whether the same outcome can be achieved on macOS, Linux or Android, while TeamViewer states more generally that code execution is possible depending on the platform.
TeamViewer's bulletin lists the Full Client, Windows Portable edition and Android Remote Control app as affected by CVE-2026-111585, but it does not list TeamViewer Host for this particular vulnerability. Even so, Host installations should also be updated because the same 15.83 release addresses two other high-severity flaws in the bulletin that do affect Host. Those additional corrections include a separate code-execution vulnerability affecting Linux and macOS.
TeamViewer provides no workaround for CVE-2026-111585. Users of the current branch should install version 15.83 or later, while people on older supported branches should use the corresponding fixed build identified in TeamViewer's bulletin. A companion bulletin issued the same day, TV-2026-1012, covers six further vulnerabilities in TeamViewer Remote Management add-ons. Those add-on fixes are delivered through automatic updates.
There was no evidence of active exploitation when the correction was published. TeamViewer said it was unaware of attacks, Remedio reported no attacks in the wild and did not release exploit code, and the flaw was absent from the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of its October 29 listing. That status does not replace the need to update because the vulnerable host only needs an accepted session to reach the viewer.
For businesses treating remote access as part of a wider security review, AEU-I offers security-first IT, infrastructure and consulting. Website operators and IT teams that use TeamViewer to maintain workstations or systems should check every Full Client, Portable, Android Remote Control and Host installation rather than assuming September's 15.82 security release resolved this flaw.