TeamViewer has patched a high-severity vulnerability, tracked as CVE-2026-111585, that allows a malicious or compromised remote host to attack the computer connecting to control it. The vulnerability has a CVSS score of 8.8 out of 10 and affects TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app. All versions before 15.83 are affected.

The vulnerability occurs when a remote host sends information about its screen dimensions to the viewer. TeamViewer uses this information to allocate memory for incoming screen data, but an integer overflow in the calculation can cause insufficient memory allocation. Consequently, incoming data may be written beyond the allocated memory boundary, causing a crash or potentially enabling code execution on the viewer's computer.

Security researcher disclosed the vulnerability, explaining that the attacker is the host and the victim is the viewer. On Windows, the researcher demonstrated that the flaw could bypass built-in operating system exploit protections and execute arbitrary code. However, the demonstration required a component on the host to supply part of the attack data, meaning it was not a fully network-based exploit. Code execution has not been demonstrated on Linux, macOS, or Android, although TeamViewer acknowledges that the impact may vary by platform.

The attack requires the victim to initiate and accept a remote-control session but does not require a password or additional interaction. The vulnerability also affects version 15.82, released in September 2026, meaning the previous security update did not resolve this issue.

TeamViewer has addressed the vulnerability in version 15.83 and later releases, with no alternative workaround available. Organizations should immediately update affected installations and also update TeamViewer Host deployments because the same release addresses two additional high-severity vulnerabilities affecting the Host. A companion bulletin also addresses six vulnerabilities in Remote Management add-ons through automatic updates.

At the time of disclosure, TeamViewer reported no known exploitation in the wild. The researcher reported no active attacks and did not release exploit code.