TeamViewer Fixes Flaw That Could Enable Code Execution on Support Technicians’ Systems
Summary
TeamViewer patched CVE-2026-111585, an integer-overflow flaw that could crash or enable code execution on a viewer’s system during a session with a malicious host. Updates also fix other code-execution and privilege-escalation flaws; TeamViewer reports no known in-the-w
Key points
- Remedio says CVE-2026-111585 is an integer overflow in TeamViewer’s remote-control screen processing that could crash the viewer or enable arbitrary code execution.
- Exploitation requires a user to establish a remote-control session with an attacker-controlled or compromised host.
- The host can provide oversized screen dimensions that cause the viewer to allocate an overflowing pixel buffer; the flaw is reachable when hardware video decoding is unavailable.
- TeamViewer client version 15.83 includes patches for Windows, macOS, Linux, and Android, with updates also released for multiple legacy versions.
- macOS and Linux updates fix CVE-2026-92372, an out-of-bounds write that could be triggered by crafted screen-image data or a specially crafted session recording; user interaction is required.
- A macOS update fixes CVE-2026-92374, a TOCTOU flaw that could let a low-privileged local attacker install a malicious package and gain root privileges.
- TeamViewer also patched six high-severity local privilege-escalation flaws in Remote Management add-ons and says it is unaware of in-the-wild exploitation of the vulnerabilities.
Article Details
- Vulnerability Types
- Integer overflow
- Out-of-bounds write
- Time-of-check-to-time-of-use (TOCTOU) race condition
- Improper symbolic link handling
- Local privilege escalation
- Severity
- CVE-2026-111585 is high severity (CVSS 8.8); the other vulnerabilities are not assigned scores in the article.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationCVE-2026-92374 could let a low-privileged local attacker exploit the macOS flaw to install a malicious package and gain root privileges.T1203 · Exploitation for Client ExecutionCVE-2026-111585 can be exploited during a TeamViewer session to execute code on the viewer’s system by overwriting a pointer in the corrupted screen surface.T1204.002 · Malicious FileCVE-2026-92372 can allow code execution when a user opens a specially crafted TeamViewer session recording (.tvs).
CVE
CVE-2026-111585Tracked as CVE-2026-111585 (CVSS score of 8.8), the flaw is described as an integer overflow affecting the remote-control screen processing component of TeamViewer clients across Windows, macOS, Linux, and Android.CVE-2026-92372The macOS and Linux updates also resolve CVE-2026-92372, an out-of-bounds write with similar consequences: an attacker could supply crafted screen-image data or convince a user to open a specially crafted TeamViewerCVE-2026-92374On macOS, the updates also resolve CVE-2026-92374, a time-of-check-to-time-of-use (TOCTOU) race condition with improper symbolic link handling flaw that could allow a low-privileged local attacker to install a malicious
Vendors
Products
TeamViewerA high-severity vulnerability in the popular remote-access tool TeamViewer could be exploited to take over a viewer’s (an IT support technician’s) system, cybersecurity firm Remedio warns.TeamViewer Remote Management add-onsTeamViewer patched six high-severity local privilege escalation vulnerabilities in the TeamViewer Remote Management add-ons, urging users to update both the clients and the components to the latest versions.