---
title: TeamViewer 15.83 fixes CVE-2026-111585 (CVSS 8.8): a malicious or compromised host can crash, and possibly run code on, the technician's viewer once a remote-control session starts | ctxsec
url: https://ctxsec.com/items/teamviewer-tv-2026-1011-cve-2026-111585-host-attacks-viewer
description: ""
status: "official (TeamViewer bulletin TV-2026-1011); not known to be exploited; code-execution demo from Remedio research"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/teamviewer-tv-2026-1011-cve-2026-111585-host-attacks-viewer.md)

official (TeamViewer bulletin TV-2026-1011); not known to be exploited; code-execution demo from Remedio research

2026-10-30

### TeamViewer 15.83 fixes CVE-2026-111585 (CVSS 8.8): a malicious or compromised host can crash, and possibly run code on, the technician's viewer once a remote-control session starts

TeamViewer bulletin **TV-2026-1011** (Oct 27) fixes three high-severity client flaws: CVE-2026-92372, CVE-2026-92374 and **CVE-2026-111585**. The last one reverses the usual direction of a remote-support attack: an integer overflow in the viewer's remote-control screen processing lets a malicious or compromised _host_ send crafted screen data that overflows a heap buffer on the _viewer_, causing a crash or, depending on the platform, code execution with the viewer's privileges. The victim only has to start a remote-control session to that host.

- **Affected (CVE-2026-111585):** Full Client and Portable before 15.83 on Windows, Linux and macOS, and the Android Remote Control app before 15.83, plus the legacy 15.64, 14.7 and 13.2 branches.
- **Fixed:** 15.83 (Full Client, Host, Portable, Android app); legacy 15.64.10, 14.7.48868, and 13.2.36231 (Windows) / 13.2.154008 (Linux) / 13.2.154007 (macOS). The Host is not listed for this CVE but the same update fixes the bulletin's other two flaws, which do affect it.
- **Exploitation:** TeamViewer says it is not aware of exploitation in the wild; France's CERT Santé lists no public proof of concept. Researchers at Remedio say they reached code execution on a Windows viewer with default settings, per SecurityWeek.

**Do now:** update help-desk and MSP technician machines first, since they connect out to many untrusted endpoints. No workaround is listed.

Sources: [TeamViewer security bulletin TV-2026-1011 (Oct 27, updated Oct 28)](https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/) · [CERT Santé (France): TeamViewer CVE-2026-111585 alert (Oct 28)](https://cyberveille.esante.gouv.fr/alertes/teamviewer-cve-2026-111585-2026-10-28) · [SecurityWeek: TeamViewer flaw could let malicious hosts take over support technicians' machines (Remedio research)](https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/)