TeamViewer 15.83 patches high-severity flaw targeting remote viewers
TeamViewer fixes a remote-session attack path
TeamViewer has released version 15.83 to address CVE-2026-111585, a high-severity vulnerability with a CVSS score of 8.8. The flaw can allow the computer being controlled in a TeamViewer session, known as the host, to attack the computer initiating control, known as the viewer.
The issue affects TeamViewer Full Client for Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control app in all releases before 15.83. TeamViewer says code execution may be possible depending on the platform, while a successful attack requires the viewer to start a remote-control session with the malicious or compromised host.
The advisory lists the Full Client, Portable edition and Android app for this CVE, rather than the TeamViewer Host product. However, the same 15.83 release fixes two additional high-severity flaws that do affect Host installations, making the update relevant to both sides of a remote-access deployment.
How the memory error can be triggered
Remedio researcher Omri Dar published technical details on October 29, describing an unusual direction for the attack: the host is the attacker and the viewer is the victim. During a remote-control session, the host supplies the dimensions of its screen image to the viewer.
The viewer uses those values to calculate the memory needed for incoming screen data. An integer overflow in that calculation can result in an allocation that is too small. Later screen data can then be written beyond the allocated memory space.
At a minimum, the condition can crash the viewer's TeamViewer session, and the host can trigger the crash repeatedly. Remedio demonstrated a Windows scenario that bypassed built-in operating-system exploit protections and executed chosen code on the viewer machine. Its demonstration used a stand-in on the host to provide part of the attack data, so the researcher did not present it as a fully network-only exploit.
The technical account does not establish whether similar code execution is possible on macOS, Linux or Android. TeamViewer's bulletin states only that code execution may be possible depending on the platform.
Patch status and operational response
Dar wrote that the attack works with TeamViewer's default configuration and needs neither a password nor an additional click after the user accepts the remote session. It also remains present in version 15.82, the security update issued by TeamViewer in September, so organisations that updated last month still need the newer release.
TeamViewer provides no workaround for CVE-2026-111585; the available remediation is an update to version 15.83 or later, including fixed builds for supported older branches. The release also addresses two other high-severity issues, including a separate code-execution flaw affecting Linux and macOS. A companion bulletin, TV-2026-1012, addresses six vulnerabilities in TeamViewer Remote Management add-ons through automatic updates.
At publication, TeamViewer said it was not aware of attacks exploiting the flaw. Remedio reported no attacks in the wild and did not publish exploit code, while the CVE was not in CISA's Known Exploited Vulnerabilities catalog as of the October 29 listing. Businesses should update TeamViewer clients and Hosts to 15.83 or later, confirm deployment status across managed endpoints, and treat connections to untrusted remote hosts as a material endpoint-security risk until patch coverage is verified.