TeamViewer is the tool a relative or an IT contractor opens to fix someone else’s computer, and a newly patched flaw turns that relationship upside down. If the person on the far end of a session is malicious, or the machine being repaired has been compromised, the helper’s own computer could be made to run attacker-chosen code. TeamViewer fixed the bug in version 15.83 on October 27, 2026.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The weakness is CVE-2026-111585, an integer overflow in the screen-processing code that handles the remote machine’s display. It carries a severity score of 8.8 out of 10. TeamViewer says it is not aware of active exploitation.
A 32-bit multiplication in screen decompression
The TeamViewer security bulletin TV-2026-1011 describes the flaw as an integer overflow in remote-control screen processing that leads to a heap-based buffer overflow. A malicious remote host can cause a denial of service or, depending on the platform, possibly execute code with the privileges of the viewer process. The bulletin was issued on October 27 and updated on October 28, is rated Important, and covers TeamViewer Remote, Tensor and ONE. The company states the precondition plainly: exploitation requires a user to establish a remote-control session with an attacker-controlled or compromised host.
The technical detail comes from the researcher who found it. Omri Dar of the security firm Remedio notified TeamViewer on August 14, 2026, according to Hackread. A 32-bit multiplication in the screen buffer constructor overflows when the host supplies oversized dimensions such as 32,768 by 32,768 pixels, so TeamViewer allocates only about 4 MB while processing the image as if the full-size buffer existed. Decompressed pixel data then overwrites adjacent heap memory.
Remedio demonstrated bypassing two Windows exploit defenses, DEP and Control Flow Guard, and redirecting execution to WinExec in a lab.
How far the demonstration went
The word could in the flaw’s description matters, and the sources differ in tone. Hackread says code execution on an unpatched system follows once the technician accepts the incoming connection, with no further clicks or password theft. A fuller SecurityLab report adds caveats from Remedio’s technical write-up: a crafted frame reliably crashes TeamViewer on Windows, the code-execution demo used host-side data manipulation to prepare memory, and full code execution over normal network traffic was not demonstrated. Any injected code would run with the TeamViewer process’s privileges, not necessarily as an administrator.
The record on the NVD side is still thin. OpenCVE lists the record as published on October 27 and awaiting analysis, with a very low exploitation-probability score below 1% and no listing in the federal catalog of known exploited vulnerabilities.
The attack path is also fairly specific. SecurityLab’s account says the malicious host can refuse the H.264 and AV1 codecs, forcing the session back to raw bitmap frames, and the host-supplied width, height and color depth then reach the vulnerable size calculation. A 32,768 by 32,768 screen at 32 bits per pixel needs about 4.3 GB, yet the overflow shrinks the allocation to roughly 4 MB. The decoder then checks coordinates against the declared screen size, not the memory actually allocated, which is why it writes past the end of the buffer.
Affected builds and the 15.83 fix
The vulnerable code is in the Full Client, including the Portable build, on Windows, Linux and macOS, and in the Remote Control app for Android, in each case before version 15.83. Older branches are covered too: the 15.64 line on Windows 7 and 8 is fixed in 15.64.10, the 14.7 line in 14.7.48868, and Windows 13.2 in 13.2.36231. TeamViewer says it strongly recommends that all users update to the latest version as soon as possible, and the bulletin lists no other mitigation.
The question for families and small offices is who sits on the exposed end. The viewer is the person giving help. A relative who connects to a grandparent’s computer, a volunteer supporting a nonprofit, and a managed-service technician working through a queue of customer machines all start sessions from the viewer side. The risk applies when that other machine cannot be trusted.
Two sibling bugs in the same bulletin
The same bulletin fixes two more problems. CVE-2026-92372 is an out-of-bounds write in the screen-image decoder for Linux and macOS, also scored 8.8, that a remote attacker could reach during a session or by tricking a user into opening a crafted session recording. CVE-2026-92374 is a macOS privilege escalation scored 7.8, caused by a race condition in the privileged helper’s package verification.
The timeline is short. TeamViewer confirmed the issue and assigned the CVE on October 22, shipped the fix five days later, and Remedio published its technical details on October 29. TeamViewer has issued a steady run of such notices this year, and its index of security bulletins lists advisories in July, August, September and twice in October. What the record does not show is whether any attacker used these flaws before the patches, since the vendor says it has no evidence of it.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
