TeamViewer has fixed a high-severity flaw that turns a routine remote-support session on its head: instead of the technician controlling the remote machine, the remote machine can attack the technician's computer. Tracked as CVE-2026-111585 and rated 8.8 out of 10, the flaw affects TeamViewer Full Client on Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control app in all versions before 15.83.

How the attack works

In a TeamViewer session, the computer that connects is called the viewer and the machine it controls is the host. Researcher Omri Dar of security firm Remedio found that a malicious or compromised host can send crafted screen-size data causing an integer overflow when the viewer reserves memory for the image. Too little memory is allocated, and later screen data is written past the end of that space, causing a heap-based buffer overflow that can crash the viewer or, on some platforms, run attacker code.

What makes it serious

The attack needs no stolen password and no extra click beyond starting the session. The flaw was demonstrated on Windows, where researchers bypassed protections to run code, although whether the same code execution works on macOS, Linux or Android was not covered in the write-up. TeamViewer said it was not aware of any attacks exploiting the flaw when it published the fix on 27 October, and the flaw is not in CISA's Known Exploited Vulnerabilities catalogue.

What users should do

Users should update to version 15.83 or later; Host users should also update, since the same release fixes two other high-severity flaws. Remedio reported the issue to TeamViewer on 14 August, and TeamViewer confirmed it on 22 October. Support teams should treat any session with an untrusted host as risky until every viewer in the team is patched.