TeamViewer bulletin TV-2026-1011 fixes three high-severity flaws in its clients, including CVE-2026-111585, where a malicious or compromised host can crash the viewer and, on Windows, run code on it. Version 15.82 from September is still affected. There is no workaround: update to 15.83.
If you use TeamViewer to help a client, a colleague or your parents, update it today. TeamViewer’s security bulletin TV-2026-1011, issued October 27, fixes three high-severity flaws in its clients. The one that matters most turns the usual risk around: the computer you connect to can attack yours.
What changed
The headline bug is CVE-2026-111585, rated 8.8 out of 10. When you start a remote-control session, the other machine (the host) tells your TeamViewer (the viewer) how big its screen image is, and your copy sets aside memory to match. Omri Dar of Remedio, who reported the bug in August, found that this size math can overflow. Your viewer then reserves too little memory, and screen data from the host spills past it.
Confirmed by TeamViewer and Remedio’s write-up:
- Who can attack: a host that is malicious or has been taken over. You still have to start or accept the session. No password and no extra click are needed beyond that, and it works in the default setup.
- What happens: at minimum the host can crash your TeamViewer whenever it wants. On Windows, Remedio got past the built-in exploit protections and ran its own code inside the viewer. Its demo used a test stand-in on the host side, so it was not a full over-the-network attack yet. Code execution has only been shown on Windows.
- What is affected: the Full Client, including the Windows Portable version, on Windows, macOS and Linux before 15.83, plus the Android Remote Control app before 15.83.
- September’s update did not fix it. Remedio tested 15.82, the version TeamViewer shipped with its last bulletin, and the bad code was still there.
The same release fixes two more flaws. CVE-2026-92372 (also 8.8) is a second screen-image bug on macOS and Linux that a crafted host or a crafted session recording file (.tvs) can use to run code. CVE-2026-92374 (7.8) lets a low-privilege local user on a Mac get root through TeamViewer’s installer helper. Both affect the Full Client and the Host. A companion bulletin, TV-2026-1012, fixes six flaws in TeamViewer’s Remote Management add-ons, which update on their own, according to The Hacker News.
TeamViewer says it knew of no attacks when it published. Remedio has not released exploit code, and the flaw was not in CISA’s list of exploited vulnerabilities as of October 29.
What to do now
1. Update to 15.83 or later on every machine. That means your own laptop and every computer you support. Host installs need it too: CVE-2026-111585 is a viewer bug, but the two macOS and Linux flaws hit the Host. Check the version number in the app, and download the current build from TeamViewer’s site if it is older.
2. On older versions, use the matching fixed build. TeamViewer patched its legacy branches: 15.64.10 for Windows 7 and 8, 14.7.48868 for the 14.7 branch, and 13.2.36231 (Windows), 13.2.154008 (Linux) or 13.2.154007 (macOS) for the 13.2 branch.
3. Until every viewer is patched, connect only to machines you trust. There is no setting that turns this off. The update is the only fix.
4. Don’t open .tvs session recordings from people you don’t know on a Mac or Linux machine that hasn’t updated yet.
What it means
Most people treat remote access as a one-way risk: protect the machine being controlled, and the person controlling it is safe. This bug breaks that. If you run IT support for a small team, or you’re the person family members call, you connect to machines you don’t manage, and some of them may already be compromised. Treat your viewer like a browser that renders whatever the other side sends. Keep it updated on its own schedule, and check versions across your team today rather than waiting for auto-update. If your company already pays for a remote-access tool, this is a good week to confirm who owns patching it. The same lesson came up with the backdoored Claude Code extension in Cursor: tools with deep access to your laptop need deliberate updates. Remote meetings get similar hardening, as in Google Meet’s post-quantum encryption and Teams’ phishing warnings for outside chats.