Connect to the Wrong PC, Get Hacked: TeamViewer Fixes a Reverse Attack
TeamViewer fixed CVE-2026-111585 (CVSS 8.8), a buffer overflow that lets a malicious host crash, and on Windows possibly run code on, the viewer that connects to it. Update to 15.83.
TeamViewer has fixed a bug that flips the usual remote-access risk around: a malicious or hacked computer can attack the person who connects to it. The flaw, CVE-2026-111585, was found by Omri Dar of Remedio, and The Hacker News reports that it at least crashes the viewer’s TeamViewer and, on Windows, Remedio got it to run code. Version 15.83 fixes it; 15.82 from September does not.
For defenders
The flaw: CVE-2026-111585, CVSS 8.8, a buffer overflow in how the viewer handles the screen size the remote host reports. The size calculation can overflow, the viewer reserves too little memory, and the screen data that follows is written past the end of it. TeamViewer’s bulletin is TV-2026-1011; Remedio’s technical write-up went up on Oct. 29.
Affected: every version before 15.83 of the TeamViewer Full Client on Windows, Linux and macOS, TeamViewer Portable for Windows, and the Android Remote Control app. The Host isn’t listed for this bug, but the same bulletin fixes two other high-severity flaws that do affect it, one of them a separate code-execution bug on Linux and macOS, so update the Host too. A companion bulletin, TV-2026-1012, covers six flaws in the Remote Management add-ons, which update automatically.
Status: no known exploitation, per TeamViewer and Remedio, and no public exploit code. It isn’t on CISA’s KEV list. The attack works on default settings: the victim only has to start a remote-control session to the attacker’s machine, which fits the classic fake tech-support or “connect to my PC so you can help” setup. Remedio’s Windows code-execution demo used a helper on the host side to feed part of the data, and other platforms weren’t shown. That’s T1203 (Exploitation for Client Execution).
Fix: TeamViewer 15.83 or later. There’s no workaround.
What it means for you
Most people think of remote-access tools as risky for the computer being controlled. This bug is the reverse: if you use TeamViewer to connect to someone else’s computer, say to help a relative or a customer, and that computer is under an attacker’s control, it can crash your TeamViewer and possibly take over your own PC. Nobody has been seen doing this yet, and the fix is a normal update.
Do this now
- Update TeamViewer to 15.83 or later on every computer and phone you use it on (Help → Check for new version on desktop, or your app store on Android).
- Only connect to computers you know and trust, and never connect out to a machine because a caller or pop-up asked you to.
- IT teams: inventory TeamViewer installs, including Portable copies that skip normal software tracking, and push 15.83 to support staff first, since they connect out to other machines all day.
CVE at a glance
- CVSS
- 8.8 High (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 21.3% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.