TeamViewer CVE-2026-111585: malicious host can execute code on support technician's viewer client
Remedio disclosed CVE-2026-111585 (CVSS 8.8), an integer overflow in the remote-control screen processing component of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can declare oversized screen geometry (e.g. 32768x32768 at 32bpp), overflowing the viewer's pixel buffer and allowing crash or arbitrary code execution on the support technician's machine. Exploitation only requires the viewer to establish an ordinary remote-control session to an attacker-controlled host, using protocol-supported messages in the default configuration, with no password and no click beyond accepting the session (thehackernews.com). Remedio demonstrated code execution by overwriting a pointer in the corrupted surface object and redirecting the call to WinExec. On Windows this bypassed the OS's built-in exploit defenses, but the demonstration used a stand-in on the host to supply part of the attack data, so it is not yet a fully network-delivered attack (thehackernews.com). TeamViewer says it has no evidence of in-the-wild exploitation; the CVE is not in CISA's KEV catalog as of October 29, and Remedio released no exploit code (thehackernews.com). Omri Dar's technical write-up was published October 29 (thehackernews.com).
Entenda a falha
A vulnerabilidade
CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing component of the TeamViewer viewer. It affects the Full Client (Windows, Linux, macOS), Portable (Windows) and the Android Remote Control app, in all versions before 15.83, including 15.82. A malicious or compromised host can crash the viewer and, depending on the platform, run code on the support technician's machine. The technician only has to start an ordinary session, with no password, no extra click and no special configuration. The bulletin does not list the Host for this CVE, but Host users should still update because 15.83 fixes two other flaws that affect it. Also fixed: CVE-2026-92372 (macOS/Linux), an out-of-bounds write from crafted screen-image data or a malicious .tvs recording that needs user interaction, and CVE-2026-92374 (macOS), a TOCTOU/symlink race that gives a local user root. Six local privilege escalation flaws were fixed in the Remote Management add-ons (bulletin TV-2026-1012).
Como funciona
In a remote-control session, the host tells the viewer the size of its screen. The viewer uses those dimensions to reserve an in-memory pixel buffer for decompressing incoming screen updates. This software decode path is used when no hardware video decoder is available, and a malicious host can refuse to negotiate video codecs to force it. If the host announces a huge surface, such as 32768x32768 at 32 bits per pixel, the size calculation overflows and the buffer is far too small. As screen data arrives, rows past 31 are written beyond the buffer and corrupt a live surface object whose first field is a function pointer, which the viewer later calls. The host controls both the declared size and the data, so it can repeat the crash at will.
Por que é vulnerável
The viewer trusts network-supplied values. In Remedio's words, the screen dimensions a host announces are used to size the drawing surface as-is, with no upper bound enforced on what arrives over the network. The size arithmetic overflows 32 bits, so the allocation no longer matches what is later written. Because the corrupted object holds a function pointer in its first field, the memory corruption can be turned into redirected execution. For CVE-2026-92372, TeamViewer cites missing destination bounds checking in the decoder. The articles do not describe the fix in detail or why the bug went unnoticed, but the 15.83 update is the only remedy and there is no workaround.
Como foi descoberta
Omri Dar, a researcher at the security firm Remedio, published a technical write-up of CVE-2026-111585 on October 29. Remedio found that the bug could go beyond a crash and give code execution on the viewer. The articles do not say how or when Remedio found the flaw or reported it to TeamViewer. TeamViewer published an advisory and fixes in 15.83 and in several legacy branches. It says it knows of no in-the-wild exploitation, and the CVE is not in CISA's KEV catalog as of October 29. The articles do not say who found CVE-2026-92372, CVE-2026-92374 or the Remote Management add-on flaws.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 15:16.
Detalhes técnicos
The host announces screen dimensions, which the viewer uses as-is to size the in-memory decompression buffer, with no upper bound enforced on network-supplied values. The vulnerable decode path is used when no hardware video decoder is available; a malicious host can refuse to negotiate video codecs to force it. Rows past 31 are written out of bounds, corrupting a live object whose first field is a function pointer. The host can trigger the crash repeatedly (thehackernews.com). Code execution was shown only on Windows; TeamViewer says only that it is possible depending on the platform (thehackernews.com). All versions before 15.83 are affected, including 15.82 released in September (thehackernews.com). macOS and Linux builds also fix CVE-2026-92372, an out-of-bounds write via crafted screen-image data or a malicious .tvs session recording (requires user interaction), and macOS fixes CVE-2026-92374, a TOCTOU/symlink race enabling local root via a malicious package install. Six further high-severity local privilege escalation flaws were patched in TeamViewer Remote Management add-ons (companion bulletin TV-2026-1012, delivered by automatic update, per thehackernews.com).
Remediação
Upgrade to TeamViewer 15.83 (Full Client, Host, Portable, Remote Control App for Android); security updates are also available for several legacy branches. TeamViewer lists no workaround; updating is the only fix (thehackernews.com). Update the Remote Management add-on components as well as the clients, and avoid initiating sessions to untrusted hosts.
Relatos divergentes
- Affected components: the earlier report lists the Host among the products to upgrade, and thehackernews.com notes that TeamViewer's bulletin lists only the Full Client, Portable and Android app for CVE-2026-111585, not the Host. Host users should still update because 15.83 fixes two other flaws that affect the Host. The bulletin as relayed by thehackernews.com is the more precise source.
- Code execution scope: the earlier report implies code execution across platforms. thehackernews.com states it was demonstrated only on Windows and is unconfirmed on macOS, Linux and Android.
Linha do tempo
-
TeamViewer fixes CVE-2026-111585: malicious host can crash or run code on the connecting viewer
The article adds that the Windows code execution bypassed OS exploit defenses but relied on a stand-in on the host, and that it was shown only on Windows. It also adds that 15.82 is affected, that no workaround exists, that the Host is not listed for this CVE, that the CVE is not in CISA KEV as of October 29, and that Remedio released no exploit code.
ler a análise desta fonte ocultar
The article adds that the Windows code execution bypassed OS exploit defenses but relied on a stand-in on the host, and that it was shown only on Windows. It also adds that 15.82 is affected, that no workaround exists, that the Host is not listed for this CVE, that the CVE is not in CISA KEV as of October 29, and that Remedio released no exploit code.
TeamViewer fixed CVE-2026-111585 (CVSS 8.8) in version 15.83. A malicious or compromised host in a remote-control session can crash the viewer's TeamViewer and, depending on the platform, may run code on the viewer's computer. Omri Dar of Remedio published the technical write-up on October 29. TeamViewer was unaware of exploitation when it published the fix, the CVE is not in CISA's KEV catalog as of October 29, and Remedio reported no in-the-wild attacks and released no exploit code.
Technical Details
The host reports its screen image size to the viewer, which uses it to allocate memory. The size calculation can overflow and reserve too little space, so screen data that arrives later is written past the end of the buffer. This is an integer overflow leading to an out-of-bounds write. At minimum the viewer session crashes, and the host can repeat the crash at will.
On Windows, Remedio bypassed the operating system's built-in exploit defenses and ran code of its choosing in the viewer. The demonstration used a stand-in on the host to supply part of the attack data, so it is not yet a fully network-delivered attack. Code execution was shown only on Windows. Whether it works on macOS, Linux or Android is not covered, and TeamViewer says only that it is possible depending on the platform. The attack needs no password and no click beyond accepting the session, and it works in the default configuration.
Affected: Full Client on Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control app, all versions before 15.83, including 15.82 from September. The bulletin does not list the Host for this flaw, but the same update fixes two other high-severity flaws that do affect the Host, including a separate code-execution flaw on Linux and macOS. Companion bulletin TV-2026-1012 fixes six more flaws in the Remote Management add-ons via automatic update.
Remediation
Update to TeamViewer 15.83 or later; fixed builds exist for older supported branches. TeamViewer lists no workaround. Host users should update as well because of the other two flaws.
-
TeamViewer CVE-2026-111585: malicious host can execute code on support technician's viewer client
ler a análise desta fonte ocultar
Remedio disclosed CVE-2026-111585 (CVSS 8.8), an integer overflow in the remote-control screen processing component of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can declare oversized screen geometry (e.g. 32768x32768 at 32bpp), overflowing the viewer's pixel buffer and allowing crash or arbitrary code execution on the support technician's machine. Exploitation only requires the viewer to establish an ordinary remote-control session to an attacker-controlled host, using protocol-supported messages in the default configuration. Remedio demonstrated code execution by overwriting a pointer in the corrupted surface object and redirecting the call to WinExec. TeamViewer says it has no evidence of in-the-wild exploitation.
Technical Details
The host announces screen dimensions, which the viewer uses as-is to size the in-memory decompression buffer, with no upper bound enforced on network-supplied values. The vulnerable decode path is used when no hardware video decoder is available; a malicious host can refuse to negotiate video codecs to force it. Rows past 31 are written out of bounds, corrupting a live object whose first field is a function pointer. macOS and Linux builds also fix CVE-2026-92372, an out-of-bounds write via crafted screen-image data or a malicious .tvs session recording (requires user interaction), and macOS fixes CVE-2026-92374, a TOCTOU/symlink race enabling local root via a malicious package install. Six further high-severity local privilege escalation flaws were patched in TeamViewer Remote Management add-ons.
Remediation
Upgrade to TeamViewer 15.83 (Full Client, Host, Portable, Remote Control App for Android); security updates are also available for several legacy branches. Update the Remote Management add-on components as well as the clients, and avoid initiating sessions to untrusted hosts.