TeamViewer vulnerability lets remote hosts crash or run code

TeamViewer released a fix for a vulnerability that lets the computer being controlled attack the machine that connected to it, according to The Hacker News. The problem affects TeamViewer clients and apps before version 15.83, and the vendor bundled the repair into that release.

TeamViewer vulnerability: what it does

The Hacker News reports that the flaw, tracked as CVE-2026-111585, allows a host, the machine being controlled, to send screen size information that causes the viewer, the machine taking control, to mis-allocate memory. Data that arrives after the miscalculation can be written past the end of the reserved space, which at minimum crashes the viewer's TeamViewer session. Omri Dar of security firm Remedio summarized the attack in plain terms, writing "the attacker is the host and the victim is the viewer." The vulnerability received a severity score of 8.8 out of 10.

Who is affected

TeamViewer told users the bug affects the Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app in versions before 15.83. TeamViewer's bulletin lists those viewer components explicitly. The vendor did not list the Host in that same bulletin, but the 15.83 release also addresses two other high severity flaws that do affect Host components, so hosts should be updated as well.

The issue works after a remote-control session is started. Remedio's write-up notes that the attack needs no password and no additional clicks beyond accepting the session when TeamViewer is set up with default options. The September security update, version 15.82, did not remove this flaw, so installing 15.82 is not sufficient.

Known risks and what the demonstrations show

According to The Hacker News summary of Remedio's analysis, the basic outcome is a reliable crash of the viewer application, which a malicious or compromised host can trigger repeatedly. Remedio also demonstrated a further step on Windows where they bypassed the operating system's exploit defenses and ran code on the viewer. That Windows result used a stand-in on the host to supply part of the attack data, and the write-up notes this was not yet an attack carried out purely over the network.

The write-up showed code execution only on Windows; whether the same technique works on macOS, Linux, or Android is not covered in the report. TeamViewer said it was not aware of any attacks exploiting this flaw when it published the fix, and Remedio reported no attacks in the wild and did not publish exploit code. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the October 29 listing reported by The Hacker News.

What you should do now

Follow these practical steps if you run or use TeamViewer for remote support:

• Update TeamViewer: move to version 15.83 or later on all affected devices, including Full Client, Portable, and Android Remote Control app builds. TeamViewer lists fixes in 15.83.
• Update hosts too: install 15.83 (or later) on host machines as well, since the same release fixes additional high severity flaws that do affect Host components.
• Review default session settings: where possible, avoid accepting remote-control sessions from unknown or untrusted hosts and require confirmation before screen sharing or control.
• Limit who can act as viewer: restrict administrative or support accounts that can initiate remote sessions, and require multi-factor authentication for those accounts where available.
• Monitor and log sessions: keep logs of remote-control sessions and watch for unexpected connections or frequent disconnects and crashes, which could indicate misuse.
• Test updates in your environment: apply the update in a controlled way and confirm that remote-support workflows still function as expected.

If you provide remote support to clients or colleagues

• Notify clients about the update and schedule maintenance windows if necessary.
• Consider temporary workarounds such as using alternative, vetted remote-control tools or out-of-band support while you verify patched deployments.

Bottom line

The Hacker News report, based on Remedio's technical write-up, shows this is a high-severity memory corruption bug that lets the host crash a viewer and, in a Windows demonstration, possibly run code. TeamViewer published a fix in 15.83 and said it knew of no active exploitation at the time of the release. Prioritise installing the 15.83 update and review who can start and accept remote-control sessions in your organization.

For a quick external check of your public-facing site and basic exposure, start with a free external scan at our security page: /security.html.