A high-severity security vulnerability has been discovered in TeamViewer, a widely used remote access and desktop control software. The flaw allows a remote computer being controlled to attack the computer that connects to it. This creates an unusual security risk because the system providing remote support can become the victim instead of the attacker. The vulnerability is tracked as CVE-2026-111585 and has received a CVSS severity score of 8.8 out of 10.
The vulnerability affects the way TeamViewer processes screen information received from a remote computer during an active session. Normally, the host computer sends information about its screen dimensions, which the viewer uses to allocate memory for displaying the screen. However, a weakness in this memory allocation process allows a malicious host to provide unusually large screen dimensions. This can cause an integer overflow, resulting in insufficient memory being allocated to handle incoming screen data.
Once the viewer receives specially crafted screen information, additional data can be written beyond the allocated memory space. This can cause the TeamViewer application on the victim’s computer to crash repeatedly. Security researchers also demonstrated that the vulnerability could be used to execute arbitrary code on the viewer’s system. According to cybersecurity firm Remedio, the code execution technique was successfully demonstrated on Windows by bypassing built-in operating system security protections.
The vulnerability was discovered and technically analysed by security researcher Omri Dar from Remedio. The attack requires the victim to establish a remote-control session with a malicious or compromised computer. Researchers explained that no additional click or password is required after the user accepts the remote session. The vulnerability can also be triggered under TeamViewer’s default configuration, making ordinary remote support connections a potential attack entry point.
TeamViewer has addressed the vulnerability in version 15.83 and later releases. The issue affects the TeamViewer Full Client on Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control application in versions released before the security fix. The September security update, version 15.82, does not resolve this particular vulnerability. TeamViewer has also released updates for supported older software branches, while additional security fixes address other vulnerabilities affecting its remote access products.
Users and IT administrators are advised to update TeamViewer to version 15.83 or the latest available release to reduce the risk of exploitation. Organisations should also ensure that remote access software used by employees and support teams is regularly updated. TeamViewer stated that it was not aware of any active exploitation of the vulnerability when the security updates were published. Security researchers have also not reported attacks exploiting the flaw in the wild or released public exploit code.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
