A newly disclosed TeamViewer vulnerability could let an attacker turn a routine remote support session against the technician providing help. Tracked as CVE-2026-111585, the flaw allows a malicious remote computer to crash the viewer application and potentially run code on the technician’s machine. TeamViewer rates it High, with a CVSS score of 8.8.
Remedio researcher Omri Dar published the technical findings on October 29, following a fix released on October 27. The attack requires the victim to establish a remote session with an attacker-controlled or compromised host. After that connection, no further click or stolen password is needed, according to Remedio.
TeamViewer Security Vulnerability
TeamViewer separates a session into a host sharing its screen and a viewer displaying it. Here, the host attacks the viewer by sending crafted screen data through the same connection used for support. This reverses the expected risk, placing the technician’s computer in danger.
The host sends a DisplayParams message containing screen width, height, and color depth. The viewer uses these values to reserve memory for incoming pixels inside an object called CBitmapBuffer. A malicious host can force this processing path by refusing AV1 and H.264 video options, making the viewer use bitmap updates instead.
The findings expand on the TeamViewer remote desktop vulnerabilities previously reported, but identify the precise calculation error behind this attack. The buffer size is calculated using 32-bit arithmetic. Oversized screen dimensions make that calculation wrap around, leaving much less memory than the viewer expects.
In Remedio’s example, a screen measuring 32,768 by 32,768 pixels at 32 bits per pixel should require more than 4.29 billion bytes after padding. Instead, the calculation reserves roughly four megabytes. The viewer still treats that small buffer as large enough for the announced screen.
The decoder checks incoming image rectangles against the declared screen dimensions, not the actual memory allocation. A rectangle can therefore pass validation while its pixels spill beyond the buffer. These writes damage nearby heap memory, causing a repeatable crash and creating a route toward code execution.
Remedio reported running chosen code on Windows while bypassing Control Flow Guard and Data Execution Prevention. However, its demonstration used a host-side hook to place the corrupting bytes, standing in for the network payload and heap preparation. That detail matters when assessing how complete the demonstrated attack was.
Affected Versions and Available Fixes
TeamViewer’s security bulletin TV-2026-1011 lists affected Full Client versions before 15.83 on Windows, Linux, and macOS, Windows Portable, and Android Remote Control. Code execution depends on the platform and runs with the viewer process’s permissions. It does not automatically mean SYSTEM or root access.
Administrators should install version 15.83 or the latest available release. Legacy deployments need the matching fixed maintenance build listed in the bulletin. This update follows earlier TeamViewer security patches, making checks important across support workstations, portable copies, and older installations that might remain outside normal update routines.
TeamViewer reported no known active exploitation when its bulletin was published. Remedio disclosed the issue on August 14. For support teams, the immediate priority is updating the viewer before connecting to untrusted computers, rather than relying on session approval alone.
AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?
