Image: Wikimedia Commons — TeamViewer Remote on Windows 11 (product screenshot; interface shown is an earlier version).
TL;DR — TeamViewer CVE-2026-111585 update 15.83 explained in one line: a flaw in TeamViewer before version 15.83 lets the computer you connect to help attack your own PC, because a screen-size calculation can overflow and corrupt memory — so update to 15.83 or later, then check the version number actually changed.
📌 KEY HIGHLIGHTS
- The flaw: CVE-2026-111585, rated 8.8 out of 10 (High), is an integer overflow in TeamViewer's screen processing that can crash the viewer or, on some platforms, run attacker code.
- The twist: the attacker is the host and the victim is the viewer — the machine being helped attacks the machine doing the helping, the reverse of what most people expect.
- The fix: TeamViewer version 15.83, released 27 October 2026 (bulletin TV-2026-1011). Updating in September to 15.82 did not fix it.
- Who must act: anyone running the Full Client on Windows, macOS or Linux, the Windows Portable edition, or the Android Remote Control app, in any version before 15.83.
- Fresh urgency: Pakistan's National CERT urged users to update on 1 November 2026, and a public proof-of-concept appeared on 31 October — it demonstrates a crash, not a finished attack.
TeamViewer CVE-2026-111585 update 15.83 explained: what went wrong
TeamViewer splits every remote session into two roles. The host is the computer being controlled; the viewer is the computer that connects and takes control. Security researcher Omri Dar of the firm Remedio found that this familiar setup hides a backwards risk: data flowing back from the host can attack the viewer.
Remedio reported the flaw to TeamViewer on 14 August 2026. TeamViewer confirmed it on 22 October, assigned it CVE-2026-111585 with a CVSS score of 8.8, and shipped the fix in version 15.83 on 27 October. Dar published the technical account on 29 October, and The Hacker News summarised it on 30 October. On 1 November, Pakistan's National CERT issued advisory NCA-25.311026 urging TeamViewer users to update now — the latest official push behind a fix that has been available for five days.
How the flaw works, in plain language
When a session opens, the host tells the viewer how big its screen image is — width, height and colour depth. The viewer uses those numbers to reserve memory for the incoming picture. The bug is in that arithmetic: TeamViewer multiplies the numbers using 32-bit maths, which can only hold values up to about 4.29 billion.
Feed it an absurd screen size and the sum wraps around to something tiny. In Remedio's example, a screen of 32,768 by 32,768 pixels at 32 bits per pixel should need more than 4.29 billion bytes of memory — but the wrapped calculation reserves only about 4 megabytes. The viewer then checks incoming picture data against the declared screen size rather than the memory it actually reserved, so pixel data spills past the end of the buffer and corrupts neighbouring memory. That is a heap-based buffer overflow.
At minimum, that crashes the viewer's session — repeatably, on demand. On Windows, Remedio says it went further, bypassing the operating system's Control Flow Guard and Data Execution Prevention defences to run code of its choosing. Two honest caveats matter here: that demonstration used a stand-in on the host side to supply part of the attack data, so it is not yet a finished network attack; and code execution was shown only on Windows. TeamViewer itself says code execution is possible depending on the platform, and that any code would run with the viewer's own privileges — not automatically as a system administrator.
Image: Wikimedia Commons — TeamViewer logo.
Who is at risk — and who is not
The attack is not automatic and it is not drive-by. It only works after you start a remote-control session to a host the attacker controls or has already compromised, and it needs no password theft and no extra click beyond accepting that session. It works in TeamViewer's default setup. That makes the exposed group specific but large: IT support staff who connect to other people's machines all day, and anyone who helps family or friends by connecting to their computers.
If you only ever receive help — someone connects to your machine while you watch — this particular flaw does not target you as the viewer. But update anyway: the same 15.83 release fixes other flaws that do affect the Host, and the next section shows why.
| TeamViewer edition | Affected | Fixed version |
|---|---|---|
| Full Client (Windows, macOS, Linux) | All versions before 15.83 | 15.83 or later |
| Portable edition (Windows) | All versions before 15.83 | 15.83 or later |
| Remote Control app (Android) | All versions before 15.83 | 15.83 or later |
| Older 14.x branch | Before the branch fix | 14.7.48868 |
| Older 13.x branch (Windows) | Before the branch fix | 13.2.36231 |
What else version 15.83 fixes
Bulletin TV-2026-1011 bundles two more flaws into the same update. CVE-2026-92372 is a memory-write bug in the screen-image decoder on Linux and macOS, reachable through a remote session and also by opening a booby-trapped TeamViewer session recording (.tvs file) — so do not open session recordings from people you do not trust. CVE-2026-92374 affects the privileged helper on macOS, where a low-privileged local user could slip a malicious installer package past verification checks and gain root access; it carries a CVSS score of 7.8. A companion bulletin, TV-2026-1012, fixes six more flaws in the Remote Management add-ons, delivered by automatic update.
TeamViewer lists no workaround for CVE-2026-111585. Updating is the only fix.
How to check your version and update in 30 seconds
Open TeamViewer, go to Help, then About TeamViewer, and read the version number. If it says anything below 15.83, update now: use Help, then Check for new version, or download the current release from TeamViewer and install it. Then check the number again — this step matters, because the September 15.82 security update did not remove this flaw, and an update that silently failed leaves you exactly where you started. On Android, check the Remote Control app's version in the Play Store and update it there. If you run an older 14.x or 13.x branch, use the branch fixes in the table above rather than assuming the current release applies.
Should you care?
✅ Verdict: Update today if you connect to other computers — it is a five-minute job. There is no known exploitation in the wild and this is not a reason to stop using TeamViewer, but the fix has been out since 27 October, a national CERT is now urging action, and a public crash demo exists. For support staff and family fixers, the risk runs in the direction nobody guards: the machine you are helping.
Why it matters for World Tech readers
TeamViewer is installed on more than 2.5 billion devices, and remote support is how much of the world's IT help actually happens — including in India, where family members and small-business technicians routinely connect to relatives' and clients' PCs. The lesson of this flaw generalises: in remote support, trust is not one-way. The person offering help can be the target, and the session itself can be the weapon. That is also why support scams remain dangerous in the other direction — never accept a remote session from an unknown caller claiming your computer has a problem; legitimate companies do not cold-call to fix your PC. For the same reason, keep the habit of updating the tools you use to help others, not just the ones that protect you.
FAQs
Is TeamViewer safe to use after updating to 15.83? Yes, as far as this flaw goes: 15.83 fixes CVE-2026-111585, and TeamViewer reported no known exploitation when it published the bulletin. No software is ever "safe" in absolute terms, but an updated TeamViewer closes this specific hole.
Do I need to update if I only let someone connect to my computer? This flaw targets the viewer, not the host, so you are not its direct target. Update anyway: 15.83 also fixes flaws that do affect the Host, and staying current is what keeps the next bulletin from catching you out.
I updated in September — am I covered? Not necessarily. The September update was version 15.82, which does not contain this fix. Open Help, then About TeamViewer, and confirm the number reads 15.83 or higher.
Has anyone actually been hacked using this flaw? Not that anyone has reported. TeamViewer said it knew of no exploitation when it published the fix, Remedio reported no attacks and did not release exploit code, and the public proof-of-concept that appeared on 31 October demonstrates a crash, not code execution. That is reassuring, not a reason to wait: public crash demos are often the step before working exploits.
What if I run an old 14.x or 13.x version? Use the branch fixes: 14.7.48868 for 14.x, and 13.2.36231 for 13.x on Windows (Linux and macOS 13.2 builds have their own fixed numbers in TeamViewer's bulletin). Better still, move to a currently supported release if your licence allows it.
Takeaway: The computer you help can now attack the computer you help from — until you update. Check your TeamViewer version, move to 15.83 or later, and verify the number changed.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
HackRead — TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff's PCs
Tech Prolonged — Update TeamViewer to 15.83, Pakistan's National CERT warns (1 Nov 2026)
Related on TechByCountry: our Ivanti Connect Secure zero-day chain CISA KEV explainer, our GitLab CVE-2026-97229 CISA KEV explainer, and our LXD MicroCloud vulnerability CVE-2026-112816 explainer.
Comments
Post a Comment