Update every TeamViewer client your technicians use to connect to other machines to 15.83. CVE-2026-111585 lets a malicious or compromised host attack the viewer, the side that opens the session. The viewer can crash or, depending on the platform, potentially run the attacker’s code.
TeamViewer fixed the flaw in bulletin TV-2026-1011 on 27 October 2026 and scores it 8.8 High in CVSS 3.1. The bulletin says TeamViewer was not aware of active exploitation when it was published.
Why the Technician’s Machine Is the Target
Most remote support advice protects the machine being supported. This flaw runs the other way. The CVE record says exploitation needs a user to open a remote-control session to a host that the attacker controls or has compromised.
- 1Technician viewer Malicious hostOpens a remote-control session
- 2Malicious host Technician viewerAnnounces a huge screen size
- 3Malicious host Technician viewerRefuses the hardware video codecs
- 4Malicious host Technician viewerSends one full-screen update
Omri Dar of Remedio found the bug. His write-up says the viewer sizes its screen buffer from the dimensions the host announces, in 32-bit math that wraps. On Windows, Remedio says it bypassed Control Flow Guard and DEP and ran its own program on the viewer.
In that demo a hook on the host placed the corrupting bytes, standing in for the heap grooming step. Remedio says an accepted session in the default configuration is enough.
These are the public signals we checked on 31 October 2026.
- CISA KEVNot seenNot listed in catalog version 2026.10.3031 Oct
- Vendor statementNot seenTeamViewer was not aware of active exploitation when it published the bulletin27 Oct
- Researcher demoYesRemedio ran its own program on a Windows viewer, with a host-side hook in the demo29 Oct
- Alerts on XYes39 public posts from 27 to 31 October name the CVE31 Oct
- Brandefense BlackholeYesSix Telegram news-channel posts repeat the bulletin or news reports31 Oct
The Blackhole posts are reposts in Telegram news channels and add nothing new. Remedio’s own post on X announced the research on 29 October.
Which TeamViewer Clients to Update
The bulletin lists the Full Client on Windows, Linux and macOS, the Portable version on Windows, the Android app and three legacy branches. Each row below is a viewer that needs the fix.
| Client | Platform | Affected | Update to |
|---|---|---|---|
| Full Client. | Windows, Linux, macOS. | Before 15.83. | 15.83. |
| Portable. | Windows. | Before 15.83. | 15.83. |
| Remote Control app. | Android. | Before 15.83. | 15.83 from the Play Store or the APK. |
| Full Client 15.64 legacy. | Windows 7 and 8. | Before 15.64.10. | 15.64.10. |
| Full Client 14.7 legacy. | Windows, Linux, macOS. | Before 14.7.48868. | 14.7.48868. |
| Full Client 13.2 legacy. | Windows. | Before 13.2.36231. | 13.2.36231. |
| Full Client 13.2 legacy. | Linux. | Before 13.2.154008. | 13.2.154008. |
| Full Client 13.2 legacy. | macOS. | Before 13.2.154007. | 13.2.154007. |
The CVE-2026-111585 record does not list TeamViewer Host; the flaw sits in the viewer. The same bulletin fixes Host in 15.83 for CVE-2026-92374, a macOS privilege escalation, so update Host as well.
On Linux and macOS, the bulletin also fixes CVE-2026-92372, rated 8.8 High. Its record says crafted screen data in a session, or a crafted .tvs session recording, can run code on the Full Client.
Six Steps Before the Next Support Session
The order follows the risk: first the machines that connect out, then the rest of the fleet, then a check that every viewer runs a fixed build.
- List every machine that opens TeamViewer sessions to other computers: technician laptops, jump hosts and shared support desktops. Include Portable copies and Android phones with the Remote Control app.
- Update those first. In TeamViewer, click Help and then Check for new version; in the Classic client, open the three-line menu. The TeamViewer update guide says auto-update checks only weekly by default.
- For a managed fleet, create an update policy with Check for new version and Install new versions automatically. TeamViewer’s policy guide recommends All updates and lets you enforce the setting on Business, Premium, Corporate and Tensor licences.
- On Linux, updates arrive through the repository that TeamViewer adds. The Linux guide says the teamviewer repo commands can pin a major version, so check that no pin holds a viewer below the fix. The guide says these commands do not work on the RPM repository.
- Until a viewer runs a fixed build, do not use it to connect to a host you have reason to distrust. On Linux or macOS, do not open .tvs recordings from unknown senders either. This step is our advice, not a vendor statement.
- Check the version in the About box of every viewer, and keep a record of which builds run on the legacy branches.
Remote Support Tools as a Way Into the Desk
Remote support software has been a target before, as in the BeyondTrust Remote Support flaw in CISA KEV. Our CVE-2026-111585 vulnerability page covers the bug and the full timeline. The remote access trojan glossary entry explains how attackers abuse legitimate remote access software.
For a managed service provider, a compromised customer machine becomes a route into the support desk. That is third-party risk in reverse, and it is our reading of the record’s compromised host condition.