TeamViewer Screen Decompression Integer Overflow (CVE-2026-111585)

The CVE record says a malicious remote host can crash the TeamViewer viewer or, depending on the platform, potentially run code "with the privileges of the viewer process." The viewer is the side that opens a remote-control session; at a support desk, that is the technician. Exploitation needs the user to connect to a host that the attacker controls or has compromised.

TeamViewer, acting as CNA, scores the flaw 8.8 High in CVSS 3.1. Neither the CVE record nor NVD carries a CVSS 4.0 score. The record credits Omri Dar with finding it, and his Remedio write-up explains the bug.

How the Overflow Works

When a session starts, the host tells the viewer the size of the screen it will stream. Remedio says the viewer uses that width, height and colour depth to size a pixel buffer, with no upper limit on the numbers.

The size is computed in 32-bit arithmetic, so large values wrap around to a small allocation. The decoder still checks each screen update against the declared size, not the real one. One full-screen update then writes far past the buffer on the heap.

Remedio says a host can force this path by refusing the hardware video codecs, which leaves the viewer on the bitmap buffer. The attacker also picks the dimensions, and with them the size of the undersized buffer.

From Crash to Code Execution

On Windows, Remedio says it bypassed Control Flow Guard and DEP and ran a program of its choosing on the viewer. It tested viewer 15.80.6.0 and says the vulnerable code was still present in 15.82.6.0.

In its demo, a hook on the host placed the corrupting bytes and stood in for the heap grooming step. Remedio says the bug is reachable in the default configuration once a session is accepted.

Who Is Most at Risk?

The risk sits with whoever connects out, not with the machine being supported. That is the help desk or managed service provider whose technicians open sessions to customer machines many times a day.

A customer machine that is already compromised could be used against the technician. That inference is ours, drawn from the record's condition of a compromised host. Our TeamViewer update steps for support desks cover what to do before the next session.

The same bulletin fixes two other client flaws. CVE-2026-92372, also 8.8 High, is an out-of-bounds write in the screen-image decoder of the Linux and macOS Full Client. Its record says a crafted session recording (.tvs) can trigger it too. CVE-2026-92374 is a local privilege escalation in the macOS Full Client and Host.

What Our Checks Showed

These are the public signals we checked on 31 October 2026.

The Blackhole posts are reposts in Telegram news channels and add nothing beyond the bulletin and Remedio's write-up. Remedio's account announced the research on X on 29 October.

Another recent heap overflow driven by crafted image data is the Pillow FlashPix heap buffer overflow. Our remote code execution glossary entry explains what an attacker can do with that kind of access.

The TeamViewer bulletin TV-2026-1011 lists the Full Client, including the Portable version, before 15.83 on Windows, Linux and macOS. It also lists the Android Remote Control app before 15.83 and three legacy branches.

The CVE record also lists Portable on the 15.64 legacy branch for Windows 7 and 8, fixed in 15.64.10. The bulletin's legacy table names only Full Client and Host builds for that branch.

TeamViewer Host is not in the affected list for CVE-2026-111585, which targets the viewer. The bulletin fixes Host in 15.83 for the macOS flaw CVE-2026-92374, so update Host as well.

The bulletin's only mitigation is the update: "15.83 or the latest version available." Our patch management glossary entry covers how to track a fix across many machines.