A recently disclosed vulnerability in TeamViewer can turn an ordinary remote support session into a serious risk for the technician on the other end. Tracked as CVE-2026-111585 and rated High with a CVSS score of 8.8, the flaw lets a malicious host crash the viewer application and, in some cases, execute code on the technician’s machine after a connection has been established.
How the flaw works
TeamViewer separates sessions into a host that shares its screen and a viewer that displays it. The vulnerability arises when a host sends crafted screen data to the viewer. Specifically, the host transmits a DisplayParams message containing screen width, height, and color depth; the viewer uses those values to allocate memory inside an object named CBitmapBuffer for incoming pixels. If the host refuses AV1 and H.264 video options, the viewer falls back to bitmap updates, forcing this code path.
The bug stems from a 32-bit arithmetic error in the buffer-size calculation. Oversized screen dimensions can cause the arithmetic to wrap around, reserving far less memory than required. For example, Remedio’s analysis shows a 32,768 × 32,768 screen at 32 bits per pixel should require more than 4.29 billion bytes after padding, but the flawed calculation ends up reserving roughly four megabytes. The decoder validates incoming image rectangles against the declared screen dimensions, not the actual allocated buffer. That mismatch lets incoming pixel data overflow the buffer, corrupt heap memory, cause repeatable crashes, and open a path toward code execution.
What the demonstration showed
Remedio researcher Omri Dar published technical findings on October 29 after TeamViewer issued a fix on October 27. In their demonstration, Remedio ran chosen code on Windows and bypassed mitigations such as Control Flow Guard and Data Execution Prevention. However, the proof-of-concept used a host-side hook to place the corrupting bytes and to prepare the heap, which is an important detail when judging how complete the end-to-end attack is in real-world network conditions.
Affected versions and the fix
TeamViewer’s bulletin TV-2026-1011 lists affected Full Client versions before 15.83 on Windows, Linux, and macOS, as well as Windows Portable and Android Remote Control. Whether code execution is achievable depends on platform specifics and runs with the permissions of the viewer process; it does not automatically grant SYSTEM or root access. TeamViewer published the fix in version 15.83 and a matching maintenance build is available for legacy deployments.
TeamViewer reported no known active exploitation when the bulletin was published. Remedio originally disclosed the issue on August 14.
What administrators and support teams should do
The immediate priority for support teams is to update the viewer to version 15.83 or the latest available release, and to apply the fixed maintenance build for any legacy installations. Because the attack requires establishing a session with an attacker-controlled or compromised host, teams should be especially cautious about connecting to untrusted machines and should not rely on session approval alone as a sufficient defense.
Licensed under CC BY-ND 4.0 International