TeamViewer Before 15.83 Can Be Attacked by the Machine You Connect To. Update, and Check the Version Twice.
Update (2026-11-01): after this post was published, a third party posted a public proof of concept for this flaw on GitHub on October 31. Its README describes a containerized lab that reproduces the integer overflow on TeamViewer 15.82.6 and shows the viewer crashing at the out-of-bounds write, with logs and screenshots. We read the README and file list only and did not run anything; what we read demonstrates a crash, not code execution. This post said no exploit code had been released, which was true of Remedio's disclosure and is no longer true of the public internet. Update to 15.83 or later.
If you use TeamViewer to connect to other machines, update to 15.83 or later. CVE-2026-111585, rated CVSS 8.8, lets a malicious or compromised host attack the viewer connecting to it. TeamViewer says it knows of no attacks, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog as of October 29. It is still a bug in the direction people do not usually guard: the machine you control attacking the machine you control it from.
How it works
The host reports the size of its screen image to the viewer. The viewer allocates memory based on that size, and the calculation can overflow and reserve too little. Later screen data is then written past the end of the buffer. At minimum that crashes the viewer's session, and the host can repeat the crash at will. On Windows, researchers at Remedio say they got past the operating system's exploit defenses and ran attacker-chosen code on the viewer. That demonstration used a stand-in on the host to supply part of the attack data, so it is not yet fully network-based, and code execution was shown only on Windows.
It needs no password and no extra click beyond accepting the session, and it works in the default setup. It only happens after the user starts a session to that host. Omri Dar of Remedio published the technical account on October 29. Remedio reported no attacks and did not release exploit code.
What to update
All versions before 15.83 of TeamViewer's Full Client (Windows, Linux and macOS), the Windows Portable edition and the Android Remote Control app. TeamViewer's bulletin is TV-2026-1011, and it lists fixed builds for older supported branches. A companion bulletin, TV-2026-1012, fixes six flaws in the Remote Management add-ons and arrives by automatic update. Version 15.83 also fixes two other high-severity flaws, one of them a code-execution flaw on Linux and macOS, so people who run the Host should update as well.
Updating to 15.82 in September did not remove this flaw. After you update, read the version number; do not assume the update took.
TeamViewer lists no workaround. Updating is the only fix.
What to do besides updating
Ours, not TeamViewer's:
- Connect only to hosts you control. The attack needs a hostile or compromised host, and the most likely source of one is a machine you were asked to help with.
- Treat support sessions as a risk to the support person. The technician's machine is the viewer, and it usually holds the most access.
- Keep the viewer on a machine with limited reach, so a crashed or compromised viewer cannot reach the rest of your network.
What we hold, and what we don't
Nothing for the feed. The report lists no indicators.
Limits
This rests on The Hacker News' October 30 summary of TeamViewer's bulletin and Remedio's account. We did not read either, and we did not test the flaw. The CVE number is as reported there.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.