A high-severity vulnerability in the popular remote-access tool TeamViewer could be exploited to take over a viewer’s (an IT support technician’s) system, cybersecurity firm Remedio warns.
Tracked as CVE-2026-111585 (CVSS score of 8.8), the flaw is described as an integer overflow affecting the remote-control screen processing component of TeamViewer clients across Windows, macOS, Linux, and Android.
Successful exploitation of the security defect could allow attackers to crash the viewer’s TeamViewer or execute arbitrary code on their system.
“Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host,” TeamViewer notes in its advisory.
The issue, Remedio says, is rooted in how the host’s screen dimension is transmitted and used in the viewer: the host announces the geometry of the screen and the viewer uses the received dimensions to allocate an in-memory pixel buffer it then uses to decompress incoming screen updates.
This decode surface is only used if a hardware video decoder is not available for the session, but the host may refuse to negotiate the video codecs, thus forcing the viewer to that path.
A host can request a surface larger than what a screen can reach, and the path accepts it. An example would be 32768 by 32768 pixels at 32 bits per pixel, which overflows 32 bits, with every row past 31 being written out of bounds.
“The screen dimensions a host announces are used to size the drawing surface as-is, with no upper bound enforced on what arrives over the network,” Remedio explains.
The attacker-controlled host controls both the declared surface and the screen updates that can overflow the buffer, causing the viewer’s application to repeatedly crash.
“That means a malicious or compromised host can trigger the bug from inside an ordinary, established session, using only messages the protocol already supports,” Remedio explains.
In addition to triggering the denial-of-service (DoS) condition over a normal TeamViewer session, Remedio discovered that it could use CVE-2026-111585 to execute arbitrary code on the viewer’s system.
“The corrupted surface is a live object the viewer later calls through a pointer in its own first field, so overwriting that pointer redirects the call,” Remedio notes, explaining that it bypassed existing protections to route the call to WinExec and run the code in the viewer.
“The surface is reachable in the default configuration. An accepted session is all it takes, and that is the product’s normal mode of operation,” the company says.
Version 15.83 of TeamViewer’s clients (including Full Client, Host, Portable, and Remote Control App for Android) contains the necessary patches. TeamViewer also released security updates for multiple legacy versions.
The macOS and Linux updates also resolve CVE-2026-92372, an out-of-bounds write with similar consequences: an attacker could supply crafted screen-image data or convince a user to open a specially crafted TeamViewer session recording (.tvs) to execute arbitrary code.
“Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction,” TeamViewer notes.
On macOS, the updates also resolve CVE-2026-92374, a time-of-check-to-time-of-use (TOCTOU) race condition with improper symbolic link handling flaw that could allow a low-privileged local attacker to install a malicious package and gain root privileges.
Additionally, TeamViewer patched six high-severity local privilege escalation vulnerabilities in the TeamViewer Remote Management add-ons, urging users to update both the clients and the components to the latest versions.
TeamViewer says it is not aware of any of these vulnerabilities being exploited in the wild.
Related: Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
