TeamViewer Flaw Lets a Remote Computer Turn the Tables on the Person Controlling It

TeamViewer has released version 15.83 to fix a flaw that works in reverse of what most people expect. A malicious or compromised host, meaning the machine being controlled, can attack the viewer, meaning the computer that connects to take control. The flaw is tracked as CVE-2026-111585 and scored 8.8 out of 10. It affects the Full Client on Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83. This includes 15.82, the September security update, so updating last month did not remove it.

According to researcher Omri Dar of Remedio, the host tells the viewer how large its screen image is. The viewer uses that figure to reserve memory, but the calculation can overflow and reserve too little, so later screen data is written past the end of that space. At a minimum, this crashes the viewer's session, and the host can repeat the crash at will. On Windows, Remedio says it bypassed built-in exploit defences and ran code of its choosing, though the demonstration used a stand-in on the host, so it was not yet a fully network-based attack. The write-up does not cover whether this works on macOS, Linux or Android. TeamViewer says only that code execution is possible, depending on the platform.

The attack needs no password and no extra click beyond accepting the session, and it works in the default setup. TeamViewer's bulletin does not list the Host for this flaw, but 15.83 also fixes two other flaws that do affect the Host, so those users should update too.