'Integer Overflow' Vulnerability in TeamViewer
Cybersecurity firm Remedio has warned of a high-severity security vulnerability in the popular remote control tool TeamViewer, which could enable attackers to gain full control over the devices of technical support technicians (Viewers). The vulnerability, tracked under the identifier CVE-2026-111585, has been assigned a severity score of 8.8 on the CVSS scale and affects the remote control screen processing component in TeamViewer applications across Windows, macOS, Linux, and Android systems.
The technical issue lies in an 'Integer Overflow' flaw when processing screen dimensions sent from the Host device to the Viewer device. According to Remedio's analysis, the host can declare massive and illogical screen dimensions, leading to the allocation of insufficient memory (buffer) on the technician's device, subsequently causing an out-of-bounds error when attempting to decompress screen updates.
How is the vulnerability exploited?
Exploiting this vulnerability requires the user (technician) to establish a remote control session with a 'host' device that is either malicious or already compromised. Once the session begins, the host can exploit the protocol to send messages that cause either a crash of the TeamViewer application (Denial of Service) or, more dangerously, the execution of arbitrary code on the technician's system.
Reports indicated that the attacker can manipulate pointers within memory to direct system operations to execute malicious commands, such as WinExec, granting them the ability to control the device that was supposed to be used for technical support.
What does this news change in practice?
This vulnerability shifts the traditional power balance in technical support sessions; instead of the technician being the controlling party, they become the potential victim. The danger lies in the fact that the attack does not require prior compromise of the technician's device, but occurs simply by accepting a connection session from a malicious 'host', making technical support tools an effective means for infiltrating corporate networks by targeting highly privileged employees.
Additional Security Updates
In addition to the main vulnerability, TeamViewer has released updates to address other vulnerabilities, including:
- CVE-2026-92372: An out-of-bounds write vulnerability in macOS and Linux systems that may allow arbitrary code execution via specially crafted session recording files (.tvs).
- CVE-2026-92374: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in macOS that may allow a local attacker to gain root privileges.
- Six other vulnerabilities related to Local Privilege Escalation in TeamViewer Remote Management extensions.
The company confirms that there is currently no evidence of these vulnerabilities being exploited in the wild and urges all users to update their applications (Full Client, Host, Portable, and Android App) to version 15.83 or later immediately.