TeamViewer Fixes High-Severity Flaw Letting Remote Hosts Attack Connecting Users
Summary
TeamViewer fixed CVE-2026-111585, which lets a malicious host crash the connected viewer and may enable code execution, depending on platform. Remedio demonstrated code execution on Windows with a host-side stand-in. Update to 15.83 or later.
Key points
- CVE-2026-111585 affects TeamViewer Full Client on Windows, Linux, and macOS, Windows Portable, and the Android Remote Control app in versions before 15.83.
- A malicious or compromised host can attack the viewer after the user accepts a remote-control session; no password or additional click is required.
- The host supplies screen dimensions used in a memory allocation calculation; an overflow can reserve too little memory, allowing later screen data to be written out of bounds and crash the viewer.
- Remedio demonstrated Windows code execution and said it bypassed built-in exploit defenses, but the demonstration used a host-side stand-in to supply part of the attack data and was not entirely network-based.
- TeamViewer says code execution may depend on the platform; the write-up did not establish whether it works on macOS, Linux, or Android.
- TeamViewer's fix is version 15.83 or later, with no workaround listed. The Host is not listed as affected by this flaw, but the same update fixes two other flaws that do affect it.
- TeamViewer said it knew of no exploitation when it published the fix; Remedio reported no in-the-wild attacks and released no exploit code.
Article Details
- Vulnerability Types
- Integer overflow
- Out-of-bounds write
- Severity
- High (8.8/10)
- Affected Versions
- TeamViewer Full Client for Windows, Linux, and macOS: all versions before 15.83
- TeamViewer Portable for Windows: all versions before 15.83
- TeamViewer Remote Control app for Android: all versions before 15.83
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
T1203 · Exploitation for Client ExecutionA malicious host can exploit the flaw while the viewer processes remote screen data; Remedio demonstrated code execution on Windows, using a stand-in on the host to supply part of the attack data.T1499.004 · Application or System ExploitationA host can trigger the flaw to crash the viewer's TeamViewer session and repeat the crash.