TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

What it is

CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing of TeamViewer clients. The direction of attack is reversed from the usual one: the remote host attacks the support technician's viewer. TeamViewer says it knows of no exploitation in the wild for this or the related bugs.

How it works

The host announces its screen geometry, and the viewer uses those dimensions to size an in-memory pixel buffer for decompressing screen updates. No upper bound is enforced on values arriving over the network. Remedio's example is 32768 by 32768 pixels at 32 bits per pixel, which overflows 32 bits and leaves every row past 31 written out of bounds.

The vulnerable path is used only when no hardware video decoder is available. A malicious host can force it by refusing to negotiate video codecs. The host controls both the declared surface and the screen updates, so it controls what overflows. The result is repeated viewer crashes (denial of service).

For code execution, Remedio found the corrupted surface is a live object that the viewer later calls through a pointer in its first field. Overwriting that pointer redirects the call. Remedio says it bypassed existing protections and routed the call to WinExec, so the WinExec demonstration is Windows-specific.

Preconditions / Affected

• The viewer must establish a remote-control session to an attacker-controlled or compromised host (TeamViewer's advisory).
• The surface is reachable in the default configuration, and the attack uses only messages the protocol already supports (Remedio).
• Clients on Windows, macOS, Linux and Android are affected.

What to do

• Update to TeamViewer 15.83, which covers Full Client, Host, Portable and the Remote Control App for Android. Updates for several legacy versions also exist, but the page does not list them.
• On macOS and Linux, the same updates fix CVE-2026-92372, an out-of-bounds write in the decoder from missing destination bounds checks. Crafted screen-image data, or a crafted session recording (.tvs file) that a user opens, can lead to code execution. This one needs user interaction.
• On macOS, the updates also fix CVE-2026-92374, a TOCTOU race with improper symlink handling. A low-privileged local attacker could install a malicious package and gain root.
• Update the TeamViewer Remote Management add-ons as well as the clients. Six high-severity local privilege escalation bugs were patched there.

Caveats

The page gives no workaround other than patching. It does not say whether the .tvs and macOS fixes ship in the same 15.83 builds for every platform, or which legacy versions were patched.