TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Swati KhandelwalOct 30, 2026Vulnerability / Endpoint Security TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run code on the viewer's computer. This works only after the user starts a remote-control session to that host. The fix is in TeamViewer version 15.83. The flaw is tracked as CVE-2026-111585 and scored 8.8 out of 10, in the high range. It affects the TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83. For this flaw, TeamViewer's bulletin lists the Full Client, Portable, and Android app, but not the Host. The same 15.83 update fixes two other flaws in that bulletin that do affect the Host, so people running the Host should update as well. Omri Dar, a researcher at security firm Remedio, published a technical account of the flaw on October 29. In this bug, he wrote, "the attacker is the host and the victim is the viewer." In a remote session, the host tells the viewer how large its screen image is. The viewer uses that size to set aside memory, but the calculation can overflow and reserve too little. Screen data that arrives afterward is then written past the end of that space. At a minimum, this crashes the viewer's TeamViewer session, and the host can trigger the crash again whenever they want. On Windows, Remedio says it took the bug further, bypassing the operating system's built-in exploit defenses and running code of its choosing in the viewer. The demonstration used a stand-in on the host to supply part of the attack data, so it is not yet an attack carried out entirely over the network. That result was shown only on Windows. Whether the same works on macOS, Linux, or Android is not covered in the write-up. TeamViewer only says that code execution is possible, depending on the platform. The attack needs no password and no extra click beyond accepting the session, and it works in TeamViewer's default setup, Dar wrote. The flaw affects all versions before 15.83, including 15.82, the security update TeamViewer released in September. Updating last month did not remove it. The only fix TeamViewer offers is to update, and it lists no workaround. Current users should move to 15.83 or later. The fixed builds for older supported branches are in the table above. The same 15.83 update also fixes two other high-severity flaws in the same bulletin, including a separate code-execution flaw affecting Linux and macOS. A companion bulletin the same day, TV-2026-1012, fixes six more flaws in TeamViewer's Remote Management add-ons, delivered by automatic update. TeamViewer said that when it published the fix, it was unaware of any attacks exploiting the flaw. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog as of its October 29 listing. Remedio reported no attacks in the wild and did not release exploit code. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. endpoint security, Remote Access Security, Vulnerability Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security Your Backup Isn't Ransomware-Proof Just Because It Exists The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them