TeamViewer CVE-2026-111585: Malicious Host Attacks Technician via Integer Overflow

On October 30, 2026, a vulnerability emerged that inverts the traditional threat model of remote support sessions. CVE-2026-111585 is an integer overflow in TeamViewer's screen processing component: the party receiving help becomes the attacker, while the technician connecting to fix the problem becomes the victim. The mechanism, discovered by Remedio researchers and documented by SecurityWeek, exploits the lack of validation on screen dimensions announced by the host to execute arbitrary code on the viewer's machine.

The CVSS score is 8.8, rated HIGH. The attack vector requires an established session (UI:R), but no special privileges or additional interaction from the technician beyond the initial acceptance. The impact is total: confidentiality, integrity, and availability are all compromised on the viewer side.

The Mechanism: When Screen Dimensions Become a Weapon

The vulnerability resides in the software decoding path triggered when the hardware video decoder is unavailable or rejected by the host. In this condition, the viewer allocates a pixel buffer based on parameters received over the network: width, height, and color depth. The product of the three dimensions is calculated in 32 bits without an overflow check.

A host can announce unrealistic geometries — the documented example is 32768×32768 pixels at 32 bits per pixel — and the wrap-around result of the operation produces an allocation size smaller than the data actually written. The screen update content, fully controlled by the host, thus overflows into the viewer's heap.

"The screen dimensions a host announces are used to size the drawing surface as-is, with no upper bound enforced on what arrives over the network" — Remedio (via SecurityWeek)

The overflow does not stop at generic memory corruption. The compromised surface is a "live" object that the viewer invokes through a pointer contained in its first field. Overwriting that pointer allows execution redirection. Researchers bypassed existing protections and routed the call to WinExec, achieving arbitrary code execution with the privileges of the TeamViewer process on the technician's system.

As Remedio notes: "The surface is reachable in the default configuration. An accepted session is all it takes, and that is the product's normal mode of operation." No special configuration, no preliminary exploit: the session itself is the vehicle.

The Traditional Model and Its Inversion

In conventional remote support architectures, the attacker compromises the client receiving assistance. The technician is considered trusted; the user asking for help is the perimeter to defend. CVE-2026-111585 subverts this logic: the host becomes the attack origin, the viewer becomes the target.

According to primary sources, the vulnerable path is active in the default configuration. Remedio's quote on "normal mode of operation" underscores that the risk does not stem from a behavioral deviation, but from the product's standard functioning. The host announces dimensions, the viewer accepts them, the buffer allocates — and if the dimensions are malicious, execution follows.

Immediate Actions

Priority actions derive directly from facts documented by primary sources:

• Update to version 15.83 or the specific patched legacy versions listed in the CVE record: 15.64.10, 14.7.48868, 13.2.36231/154007/154008. Per CVE.org and OffSeq Radar, these are the only versions integrating the fix for CVE-2026-111585.
• Verify the update chain for TeamViewer Full Client, Portable, and Remote Control App across all affected platforms: Windows, macOS, Linux, and Android. The vulnerability affects all these editions.
• Realign the risk model for inbound support sessions: treat every host as a potential attacker regardless of the apparent context of the request.
• Monitor patch adoption across the installed base. OffSeq Radar reports EPSS 0.2%, Strix reports EPSS 0.29%: both values are not independently verified and indicate separate estimates with identical reliability limits.

What Changes for Support Teams

The key point is the attack direction. It is no longer sufficient to protect the host receiving help: the technician connecting is now exposed to direct compromise through the session channel itself. The implicit trust in the protocol — the host announces, the viewer accepts — becomes the exploit mechanism.

The same October patch also fixes CVE-2026-92372, an out-of-bounds write on macOS and Linux, and CVE-2026-92374, a TOCTOU race condition on macOS. According to SecurityWeek, these vulnerabilities are resolved by the same version 15.83, but do not share the same attack vector as CVE-2026-111585.

The Risk Perimeter and Affected Versions

The CVE.org record and the NVD database confirm the vulnerable version matrix. The entire product lifecycle is touched: from current releases down to legacy versions still deployed in enterprise environments. Remediation requires active intervention on every endpoint acting as a viewer, not just on centralized management servers.

The cross-platform nature of the vulnerability amplifies the exposure surface. Windows, macOS, Linux, and Android share the same vulnerable path in the software decoder, making the risk uniform regardless of local infrastructure.

Editorial Close

CVE-2026-111585 represents an underestimated risk category: trust inversion in the communication protocol. It is not the attacker forcing entry; it is the system accepting malicious data from a source considered legitimate. The lesson for security teams is that input validation cannot depend on the apparent identity of the sender, even in an authorized support context.

TeamViewer has released the patch, detected no active exploits, and the vector still requires an established session. These factors contain the immediate risk, but do not eliminate the need to update. Version 15.83 is the technical answer; threat model recalibration is the strategic answer.