Cybersecurity

TeamViewer Flaw Lets Malicious Hosts Target Support

A high-severity integer overflow flaw tracked as CVE-2026-111585 impacts TeamViewer clients across Windows, macOS, Linux, and Android, potentially allowing malicious hosts to execute arbitrary code on support technicians' machines.

Radwan AbdulhadiEditor and technology writer

Published: October 31, 2026 · Updated: October 31, 2026 · 4 min read

TeamViewer Flaw Lets Malicious Hosts Target Support — Image: SecurityWeek

Understanding the TeamViewer Integer Overflow Flaw

A high-severity vulnerability in the popular remote-access tool TeamViewer could be exploited to take over a viewer’s system, cybersecurity firm Remedio warns. Tracked as CVE-2026-111585 and carrying a CVSS score of 8.8, the security defect is described as an integer overflow affecting the remote-control screen processing component of TeamViewer clients across Windows, macOS, Linux, and Android. Successful exploitation of the flaw could allow attackers to crash the viewer’s TeamViewer application or execute arbitrary code directly on their system.

According to details provided by TeamViewer notes in its advisory, exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host. Cybersecurity researchers note that the issue stems from how screen dimensions transmitted by a host are handled and utilized by the viewer application.

How the Technical Exploitation Mechanism Works

Further technical analysis published by Remedio says indicates that the vulnerability is rooted in how the host’s screen geometry is transmitted and used in the viewer. The host announces the dimensions of its screen, and the viewer uses these received numbers to allocate an in-memory pixel buffer, which it subsequently relies on to decompress incoming screen updates.

This decode surface is typically only utilized if a hardware video decoder is unavailable for the active session. However, a malicious host may refuse to negotiate video codecs, forcing the viewer onto this alternative software path. The host can then request a drawing surface significantly larger than normal screen limitations, and the application path accepts it without enforcing upper bounds.

For instance, an attacker could demand 32,768 by 32,768 pixels at 32 bits per pixel, creating a scenario that overflows 32 bits and writes every row past the 31st out of bounds. Because the screen dimensions announced by a host dictate the drawing surface size without boundary enforcement, the attacker-controlled host controls both the declared surface and the incoming screen updates.

Arbitrary Code Execution and Denial of Service

Beyond triggering a repeated denial-of-service crash condition inside an ordinary, established session using standard protocol messages, Remedio discovered that CVE-2026-111585 can achieve arbitrary code execution. The corrupted surface operates as a live object that the viewer eventually calls through a pointer residing in its own first field. By overwriting that pointer, attackers can successfully redirect the call.

Researchers explained that they successfully bypassed existing protective measures to route the call to WinExec, ultimately executing arbitrary code within the context of the viewer's system. Because this surface is reachable in default configurations, an accepted session—representing the standard operational mode of the software—is all that is required for an attacker to initiate the attack sequence.

Patches and Additional Vulnerabilities Addressed

To address these security issues, version 15.83 of TeamViewer clients—including the Full Client, Host, Portable, and Remote Control App for Android—has been released and contains the necessary fixes. Furthermore, the company has released security updates for multiple legacy versions to protect users who have not yet upgraded.

In addition to fixing the primary integer overflow, the macOS and Linux updates resolve CVE-2026-92372, an out-of-bounds write flaw with similar consequences. This secondary defect allows an attacker to supply crafted screen-image data or trick a user into opening a specially crafted TeamViewer session recording file (.tvs) to execute arbitrary code, though it requires user interaction.

On macOS platforms, the patches also resolve CVE-2026-92374, a time-of-check-to-time-of-use race condition involving improper symbolic link handling that could allow a low-privileged local attacker to install a malicious package and gain root privileges. TeamViewer has also patched six additional high-severity local privilege escalation vulnerabilities located within the TeamViewer Remote Management add-ons, urging users to apply patches across both clients and components.

Current Threat Intelligence Status

At the time of disclosure, TeamViewer confirmed that it is not aware of any active exploitation of these specific vulnerabilities in the wild. Nevertheless, system administrators and IT support technicians are strongly advised to update their software installations promptly. Detailed information regarding the updates and legacy versions can be found through official channels.