TeamViewer CVE-2026-111585 and CVE-2026-92372: a malicious host can run code on the computer that connects to it

What happened

TeamViewer published bulletin TV-2026-1011 on 27 October 2026, rated Important, with three CVEs fixed in 15.83 (TeamViewer). The unusual part is the direction of the attack: the machine being supported attacks the person supporting it.

• CVE-2026-111585 (CVSS 8.8): an integer overflow when the viewer processes the remote screen. The host reports its screen size, the viewer’s size calculation overflows, too little memory is reserved, and later screen data is written past the buffer. A malicious or compromised host can crash the viewer or, depending on platform, run code with the viewer’s privileges. Affected: Full Client and Portable on Windows, Linux and macOS, and the Android Remote Control app, before 15.83 (CVE record; The Hacker News).
• CVE-2026-92372 (CVSS 8.8): an out-of-bounds write in the screen-image decoder of the Full Client on Linux and macOS. It can be triggered during a session or by getting a user to open a crafted TeamViewer session recording (.tvs) (TeamViewer).
• CVE-2026-92374 (CVSS 7.8): a time-of-check, time-of-use race plus symlink handling in the macOS privileged helper. A low-privileged local user can bypass installer package checks and get root. Affects the Full Client and Host on macOS (TeamViewer).

Omri Dar of Remedio found CVE-2026-111585 and published a write-up on 29 October. He says the attack needs no password and no click beyond accepting the session, and works in the default setup. Remedio showed code execution only on Windows, with part of the attack data supplied by a stand-in on the host. It did not release exploit code (The Hacker News). Version 15.82, the September security update, is still vulnerable.

A companion bulletin, TV-2026-1012, fixes six local privilege escalation flaws (up to CVSS 7.8) in the Remote Management add-ons: Monitoring, Patch Management and Advanced Asset Management. Those components update automatically (TeamViewer TV-2026-1012).

TeamViewer says it was not aware of active exploitation when it published either bulletin. None of the CVEs was in CISA’s KEV catalog as of 30 October (CISA KEV).

Am I affected?

The people at risk from CVE-2026-111585 and CVE-2026-92372 are the ones who connect out: helpdesk staff, IT admins and managed service providers. Check the client version on their machines:

# macOS
defaults read /Applications/TeamViewer.app/Contents/Info.plist CFBundleShortVersionString

# Debian or Ubuntu
dpkg -l | grep -i teamviewer

# RHEL, Fedora or SUSE
rpm -qa | grep -i teamviewer

# Windows
(Get-Item "$env:ProgramFiles\TeamViewer\TeamViewer.exe").VersionInfo.ProductVersion

Anything below 15.83 is affected, unless it is one of the fixed legacy builds: 15.64.10 (Windows 7 and 8), 14.7.48868, 13.2.36231 (Windows), 13.2.154008 (Linux) or 13.2.154007 (macOS) (TeamViewer). Do not forget TeamViewer Portable copies on USB sticks and in download folders, which no package manager sees, and the Android Remote Control app on staff phones.

Macs with the TeamViewer Host installed for unattended access are exposed to the local root bug, CVE-2026-92374.

What to do now

1. Update viewers first: Full Client, Portable and the Android Remote Control app to 15.83, or the fixed legacy build for your branch. TeamViewer lists no workaround.
2. Update Hosts too, especially on macOS, for CVE-2026-92374 and because TV-2026-1012 is fixed through the same 15.83 release.
3. Until every viewer is patched, do not connect to hosts you do not control. Inbound support requests from unknown parties and connections to machines that may already be compromised are the attack path.
4. Do not open .tvs recordings from outside the organisation on Linux or macOS clients older than 15.83.
5. Check the Remote Management add-ons if you use them. They update automatically, but confirm Monitoring is at 26.10.1 and Patch Management at 26.9.1 (24.12.5 for the 14.7 client) (TeamViewer TV-2026-1012).

Why this matters

Remote support tools are normally threat-modelled one way: protect the machine being controlled. Here the controlled machine attacks the controller. Helpdesk and MSP technicians connect to many unknown or already infected machines a day, and their own workstations usually hold more access than any one customer machine.

Sources

• TeamViewer security bulletin TV-2026-1011
• TeamViewer security bulletin TV-2026-1012
• CVE record: CVE-2026-111585
• The Hacker News: TeamViewer flaw lets remote computers attack viewers
• CISA Known Exploited Vulnerabilities catalog