Remote support usually runs one way. A technician dials into a customer machine, and the customer is the party exposed to risk. TeamViewer has now shipped a fix for a bug that reverses that equation.
Tracked as CVE-2026-111585 and scored 8.8, the flaw lets a malicious or already-compromised host attack the viewer. Crashes are the floor. On Windows, the researcher who found it pushed the bug past the operating system’s exploit mitigations and ran chosen code on the technician’s PC. macOS, Linux and Android have not been tested to that depth.
The mechanism is a bad size calculation. A host reports how large its screen image is. The viewer reserves memory from that number, the arithmetic overflows, and incoming screen data overruns the buffer.
Version 15.83 and later carry the fix. Everything before it is affected, including 15.82, September’s security release. TeamViewer lists no workaround, so patching is the whole remedy.
Two more high-severity bugs arrived in the same bulletin, one a separate code-execution issue on Linux and macOS. A companion notice, TV-2026-1012, covers six flaws in the Remote Management add-ons and is delivered automatically.
The blast radius is not only the viewer’s desktop. Support engineers often hold credentials and admin sessions that reach far past the machine they are sitting at, which makes the workstation a worthwhile target in its own right.
TeamViewer said it saw no exploitation when the patch shipped, and Remedio, the firm that reported the bug, published no exploit code. That means the window for quiet abuse may still be open rather than closed.
Defenders should inventory every build of the Full Client, the Portable edition and the Android Remote Control app, then confirm 15.83 landed. Resellers and MSPs running shared fleets should check both sides of each session, host and viewer alike.
