TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

Security researchers at Remedio identified a high-severity bug, CVE-2026-111585 (CVSS 8.8), in TeamViewer clients for Windows, macOS, Linux, and Android that lets a malicious or compromised remote-control host attack the technician viewing the session. The flaw stems from an integer overflow in how screen dimensions announced by the host are used to allocate the viewer's pixel buffer, which attackers can abuse to crash the application or, as Remedio demonstrated, hijack a pointer to achieve arbitrary code execution on the support technician's machine simply by establishing an ordinary session. TeamViewer has shipped version 15.83 along with updates for several older releases to close the hole, and also fixed a related out-of-bounds write bug (CVE-2026-92372) on macOS and Linux plus a macOS privilege-escalation issue (CVE-2026-92374) and six high-severity local privilege escalation flaws in the Remote Management add-ons. The vendor says none of these issues have been exploited in the wild so far, but urges all users to update both clients and add-on components promptly.