Vulnerabilities · Application Security
TeamViewer flaw could let attackers take over support technicians’ computers
A critical TeamViewer bug could let attackers control IT support technicians’ systems during remote sessions. Patches are available, but users must update to stay safe.
Ross Grant2 min read
The short version
A serious bug has been found in TeamViewer, a tool used for remote IT support. If a support technician connects to a hacked or malicious computer, the attacker could take control of the technician’s own system. TeamViewer has released updates to fix the problem. Users should update their software to stay safe.
What happened?
A critical vulnerability in TeamViewer (CVE-2026-111585) could let attackers take over support technicians’ computers during remote sessions. The flaw affects Windows, macOS, Linux and Android clients. TeamViewer has released patches, but exploitation requires a technician to connect to a malicious or compromised host. Only SecurityWeek has reported this so far.
How the flaw works
A high-severity vulnerability in TeamViewer, tracked as CVE-2026-111585, could let an attacker take control of a support technician’s computer during a remote session. The flaw is an integer overflow in how TeamViewer processes screen dimensions sent by the remote host. If a technician connects to a malicious or compromised host, the host can declare a screen size so large that it causes TeamViewer to miscalculate memory allocation. This can lead to a buffer overflow, where data is written outside the intended area in memory.
The attack works even in TeamViewer’s default configuration. The host can force the viewer (the technician’s system) to use a vulnerable code path by refusing to negotiate video codecs, making the viewer handle screen updates in software. By sending crafted screen dimensions and updates, the attacker can crash the viewer’s application or, in some cases, execute their own code on the technician’s machine. This means the attacker could potentially install malware or take further control of the system.
Who is affected
The vulnerability affects TeamViewer clients on Windows, macOS, Linux and Android. All types of TeamViewer clients are impacted, including Full Client, Host, Portable, and the Remote Control App for Android. The flaw is present in the normal mode of operation, so any support technician connecting to a compromised or malicious host could be at risk.
The response
TeamViewer has released patches in version 15.83 for all affected clients. Security updates are also available for multiple legacy versions. The company says it is not aware of any attacks exploiting this vulnerability in the wild so far. TeamViewer has also patched related vulnerabilities on macOS and Linux, including another code execution bug (CVE-2026-92372) and a privilege escalation issue (CVE-2026-92374). Six high-severity local privilege escalation bugs in Remote Management add-ons have also been fixed.
What you should do
Users and organisations should update TeamViewer clients and all related components to the latest versions as soon as possible. This includes both the main application and any add-ons. Support teams should be cautious when connecting to unknown or untrusted hosts, as exploitation requires the technician to initiate a session with a compromised system. Regular patch management and user awareness are key to reducing the risk from these types of vulnerabilities.
Why it matters
Remote support tools like TeamViewer are widely used in businesses and IT support. A flaw that lets attackers take over technicians’ systems could lead to wider breaches, malware infections or data loss.
Key points
- A TeamViewer bug could let attackers control support technicians’ computers.
- The flaw affects Windows, macOS, Linux and Android clients.
- Attackers need the technician to connect to a compromised or malicious host.
- Patches are available in TeamViewer version 15.83 and later.
- No attacks have been reported in the wild so far.
Sources
SecurityWeek
Reference
