"the attacker is the host and the victim is the viewer." — Omri Dar, Remedio
CVE-2026-111585: a high-severity remote-session flaw
TeamViewer fixed a vulnerability tracked as CVE-2026-111585 in version 15.83 after security researcher Omri Dar of Remedio published a technical account on October 29. The flaw carries a score of 8.8 out of 10 and affects TeamViewer Full Client builds on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app in all versions before 15.83. According to Remedio, exploitation requires only that a user start a remote-control session to a malicious or compromised host.
How the bug is abused: crash first, code execution on Windows demonstrated
In a TeamViewer session the controlled machine is the host and the connecting machine is the viewer. The vulnerability arises because the host tells the viewer how large its screen image is; the viewer uses that value to reserve memory. Remedio showed the arithmetic can overflow so the viewer reserves too little memory, and subsequent screen data is written past that region. At a minimum the overflow crashes the viewer's TeamViewer session and the host can trigger repeated crashes at will.
Remedio also took the bug further on Windows: the researcher demonstrated bypassing the operating system's exploit mitigations to run code of the attacker's choosing on the viewer. That Windows result used a stand-in on the host to supply part of the attack data, and Remedio's write-up notes that the demonstration is not yet an attack carried out entirely over the network. Whether the same code-execution method works on macOS, Linux, or Android is not addressed in the write-up. TeamViewer's bulletin states code execution is possible depending on the platform.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScope, defaults, and the absence of a workaround
Remedio reported the attack needs no password and no extra click beyond accepting the remote session; it works in TeamViewer's default setup. The flaw affects every release before 15.83, including 15.82 — the September security update — meaning the prior update did not remove this vulnerability. TeamViewer lists no workaround; its only remedial action is to install the 15.83 update or later. The vendor's bulletin also says fixed builds for older supported branches are shown in a table accompanying the advisory.
What TeamViewer patched and related fixes
TeamViewer's 15.83 release corrects CVE-2026-111585 and two other high-severity flaws noted in the same bulletin, one of which is a separate code-execution issue affecting Linux and macOS. A companion bulletin, TV-2026-1012, issued the same day addresses six additional flaws in TeamViewer's Remote Management add-ons and is delivered by automatic update. Notably, TeamViewer's bulletin explicitly lists the Full Client, Portable, and Android Remote Control app for CVE-2026-111585 but does not list the Host; because the 15.83 update also fixes other Host-affecting issues, the vendor advises that people running the Host should update as well.
What this means for technologists, end users, and enterprises
- Technologists and security teams: Apply TeamViewer 15.83 (or later) across Full Client, Portable, and Android Remote Control installations, and ensure Host builds are updated too because related fixes affect the Host. Note that the bulletin provides fixed builds for older supported branches in an accompanying table.
- End users and general users: Do not accept remote-control sessions from unknown or untrusted hosts; updating to 15.83 is the only fix TeamViewer lists and there is no workaround that removes the vulnerability while staying on older releases. The attack requires only that you accept the session in the default configuration.
- Enterprises and procurement leaders: Prioritize deploying 15.83 across managed endpoints. Be aware that a proof-of-concept demonstration achieved code execution on Windows with auxiliary data supplied from the host side, highlighting the need for timely patching in environments that permit external remote-control sessions.
When TeamViewer published the fix it said it was unaware of any active exploitation; Remedio reported no attacks in the wild and did not release exploit code. The vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog as of the October 29 bulletin.
The technical record is clear and narrow: a host can destabilize or, under specific demonstrations on Windows, run code on a connected viewer after a user accepts a session. The immediate, practical step the vendor provides is binary — update to 15.83 or remain exposed — and, as of the advisory, there is no evidence of exploitation in the wild nor public exploit code.
