Support techs: a TeamViewer bug lets the computer you connect to attack yours. Update to 15.83

Remote support usually means you worry about the person connecting in. TeamViewer has fixed a bug that works the other way: a malicious or hacked computer you connect to can crash your TeamViewer and, depending on the platform, run code on your machine.

That puts the risk on the technician’s laptop, the one that holds the most access. TeamViewer says it knows of no attacks, and no exploit code is public.

With this TeamViewer bug, the machine you are fixing can attack the machine you are fixing it from.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

A TeamViewer bug runs backwards, from the customer’s PC to yours

TeamViewer’s bulletin TV-2026-1011, issued October 27, fixes CVE-2026-111585, an integer overflow in how the client processes the remote screen. It is rated CVSS 8.8. In TeamViewer’s words, a malicious remote host may cause a denial of service or, depending on the platform, “potentially execute arbitrary code with the privileges of the viewer process.” The user has to start a remote-control session to that host first.

Omri Dar of Remedio published the technical write-up on October 29, The Hacker News reports. The host tells the viewer how big its screen is, the size calculation overflows, and later screen data is written past the end of a buffer that is too small. On Windows, Remedio ran code of its choosing in the viewer, though its demo used a stand-in on the host for part of the attack data.

Help desks and MSPs that connect out to other people’s machines

Affected: TeamViewer Full Client and Portable on Windows, Linux and macOS, and the Android Remote Control app, all before 15.83. That includes 15.82, the September security release, so updating last month did not cover this.

The same bulletin fixes two more bugs. CVE-2026-92372 (CVSS 8.8) is a screen-decoder flaw on Linux and macOS that can also be triggered by opening a booby-trapped session recording (.tvs file). CVE-2026-92374 (CVSS 7.8) lets a local user on a Mac become root through the TeamViewer installer helper, and it affects the Host too.

Move every TeamViewer client to 15.83

• Update every TeamViewer Full Client, Portable copy and Host to 15.83. TeamViewer lists no workaround.
• On older supported lines, use the legacy builds in the bulletin: 15.64.10 for Windows 7 and 8, 14.7.48868, or the 13.2 builds for each platform.
• Update the TeamViewer Remote Control app on Android phones and tablets that technicians use, to 15.83 from Google Play.
• Tell support staff not to open .tvs session recordings that arrive by email or ticket until their Linux or Mac client is patched.

Details

• CVE-2026-111585: integer overflow in remote-control screen processing, CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R). Full Client and Portable before 15.83 on Windows, Linux and macOS; Remote Control app for Android before 15.83; legacy 15.64, 14.7 and 13.2 lines.
• CVE-2026-92372: out-of-bounds write in the screen-image decoder, Full Client for Linux and macOS before 15.83, CVSS 8.8; also reachable through a crafted .tvs recording.
• CVE-2026-92374: TOCTOU race and symbolic-link handling in the macOS privileged helper, Full Client and Host before 15.83, local privilege escalation to root, CVSS 7.8.
• Exploitation: none known to TeamViewer at publication (bulletin updated October 28). Not on CISA’s KEV list.

Hunt / verify

• Pull TeamViewer versions from your software inventory or RMM, and include portable copies on technicians’ USB drives and shared folders.
• Look for TeamViewer viewer crashes on support machines since late October. The Hacker News notes a malicious host can trigger the crash again whenever it wants.
• On Macs, review recent installer activity by TeamViewer’s privileged helper if non-admin users share those machines.

Source: TeamViewer bulletin TV-2026-1011; The Hacker News report

Sources

• TeamViewer: Security Update for Vulnerabilities in TeamViewer Clients (TV-2026-1011)
• The Hacker News: TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
• SecurityWeek: TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
• NVD: CVE-2026-111585

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].