TeamViewer's viewer needs patching before connecting to an untrusted host

TeamViewer has patched CVE-2026-111585, a screen-processing flaw that lets a malicious remote host attack the computer viewing its screen. For a support technician, connecting outward to help someone can expose the technician’s own client.

The October 27 security bulletin identifies 15.83 as the fixed current release. It says exploitation requires establishing a remote-control session to an attacker-controlled or compromised host. The potential outcome is a crash or, depending on the platform, code execution with the viewer process’s privileges.

Evidence status: disclosed vulnerability and controlled research demonstrations. TeamViewer says it knew of no active exploitation in the wild at publication. That dated statement does not establish that every earlier session was safe.

The screen stream crosses a trust boundary

Omri Dar’s Remedio research traces the flaw to an integer overflow, arithmetic exceeding its storage range. The client allocates a smaller image buffer than the dimensions it later trusts when decoding incoming screen updates.

Dar reports that a hostile host can steer the Windows viewer toward the affected bitmap-processing path. Checks against the declared screen dimensions then fail to protect the smaller allocation. A normal remote-control session supplies the transport; stealing the technician’s password is not the described prerequisite.

The research distinguishes two demonstrations:

• Session delivery and crash: Remedio says it confirmed that attacker-controlled screen data reaches the vulnerable path through an established session.
• Code execution: Remedio reports execution on shipping Windows binaries with their protections enabled. Its demonstration uses a host-side hook to place corrupting bytes, standing in for the wire payload and heap preparation.

That second qualification matters. The published account supports a serious memory-corruption finding, but its code-execution demonstration is not an independently reproduced, complete over-the-network attack.

Remedio tested Windows 15.80.6.0 and reports the vulnerable constructor still present in 15.82.6.0. Those are research observations. TeamViewer’s bulletin supplies the broader product and platform scope.

Update the client doing the viewing

For this CVE, TeamViewer lists affected Full Client and Portable clients, plus its Android Remote Control app. The current Full Client scope includes Windows, Linux and macOS before 15.83. Android Remote Control versions before 15.83 are also affected.

Install 15.83 or a later appropriate supported release through TeamViewer’s official distribution path. Include portable copies and support workstations in the inventory; updating only the computer receiving support leaves the viewer to check separately.

For retained maintenance branches, the vendor lists these fixed Full Client builds:

The TeamViewer-maintained CVE record also lists 15.64.10 for the legacy Windows Portable branch. Match the actual component, operating system and maintenance line rather than comparing every installation against one version number.

Keep the bulletin’s separate flaws separate

The same bulletin fixes CVE-2026-92372, a different screen-decoder out-of-bounds write affecting Linux and macOS clients. That entry also describes exposure through a crafted .tvs session recording.

The bulletin assigns that recording-file route to CVE-2026-92372. It does not make it a demonstrated route for CVE-2026-111585. Its third issue, CVE-2026-92374, concerns local privilege escalation through macOS package handling.

For support operations, the immediate action is to verify the viewing client’s fixed build before connecting to an untrusted or potentially compromised machine. Keep any investigation of suspicious prior sessions separate from patch completion.

Caveat: Remedio sells security and remediation products, and TeamViewer supplies the fix matrix. The reviewed material contains no independently measured exploitation rate or complete cross-platform reproduction.