TeamViewer Flaw Could Let Hosts Take Over Support Machines

A high-severity flaw in TeamViewer’s remote-access product could let a malicious host seize control of a support technician’s machine during a remote-session. Security firm Remedio describes CVE-2026-111585 as an integer overflow in the viewer’s screen processing path, affecting TeamViewer clients across Windows, macOS, Linux and Android. Exploitation can crash the viewer or allow arbitrary code execution.

TeamViewer’s advisory notes that an attacker must establish a remote-control session to a compromised or attacker-controlled host for successful exploitation.

Remedio explains the vulnerability stems from how the host’s screen geometry is transmitted and used to allocate an in-memory pixel buffer for decompressing screen updates; if the host negotiates a surface larger than the actual display (for example 32768 by 32768 at 32 bits per pixel), the 32‑bit length overflows and writes past the buffer, enabling a code path control.

The issue is complemented by related fixes in TeamViewer’s updates.

Version 15.83 of TeamViewer’s Full Client, Host, Portable and Remote Control App for Android contains the required patches; updates were also released for multiple legacy versions. macOS and Linux patches cover CVE-2026-92372, an out-of-bounds write triggered by crafted screen-image data or a malicious .tvs session, while macOS also addresses CVE-2026-92374, a TOCTOU race condition with improper symbolic-link handling that could allow local privilege escalation.

In addition, fixes were provided for six high-severity local privilege-escalation vulnerabilities in the TeamViewer Remote Management add-ons. TeamViewer states it is not aware of any of these flaws being exploited in the wild.