# TeamViewer Flaw CVE-2026-111585 Lets Remote Hosts Attack Your PC

- URL: https://usa-24.com/teamviewer-vulnerability-patch-now/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-31T21:37:27.318Z
- Updated: 2026-10-31T21:37:27.323Z
- Topics: Cybersecurity, TeamViewer, Remote Access, Security Updates, IT Support

> A patched TeamViewer flaw lets a malicious remote computer attack the technician who connects to it. Users should update to TeamViewer 15.83 or later.

## Key takeaways

- TeamViewer CVE-2026-111585 is rated 8.8 out of 10 and lets a malicious host attack the viewer that connects to it.
- The fix is TeamViewer 15.83, released October 27, 2026, and reporting says every version before 15.83, including 15.82, is affected.
- Exploitation needs no password and no extra click beyond accepting the session, according to researcher Omri Dar's account.
- TeamViewer said it knew of no attacks when it shipped the fix, and the flaw was not in CISA's KEV catalog as of October 29.
- Dar's public demonstration used a stand-in on the host, so the attack is not yet shown to work fully over the network.

A newly disclosed TeamViewer vulnerability lets a remote computer attack the technician or support worker who connects to it. The flaw, tracked as CVE-2026-111585 and rated 8.8 out of 10, is fixed in TeamViewer 15.83. Anyone who uses the software to support customers, coworkers or family members should update now.

## What the TeamViewer vulnerability does

The bug is an integer overflow in the screen-decompression component, according to [Cybersecurity News](https://cybersecuritynews.com/teamviewer-security-flaw/) and [HackRead](https://hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/). The machine being controlled, called the host, can attack the viewer that connected to it. A malicious or compromised host can crash the viewer and, depending on the platform, possibly run code, [The Hacker News](https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html) reported.

This is close to the reverse of the usual remote-access threat model. Most people think of the controlled machine as the one that needs protecting, and the technician's laptop as the safe place to start from. This flaw turns that assumption around, because the viewer is the machine at risk.

TeamViewer shipped the fix in version 15.83 on October 27, 2026. Remedio had notified the company on August 14, and TeamViewer confirmed the issue on October 22. Remedio security researcher Omri Dar published a technical write-up on October 29, and that write-up is what pushed the flaw into the headlines.

## Which TeamViewer versions are affected

Bulletin TV-2026-1011 covers the TeamViewer Full Client before 15.83 on Windows, Linux and macOS, along with Windows Portable and Android Remote Control. The Hacker News reports that every version before 15.83 is affected, including 15.82, the September 2026 security update. That detail matters, because many people assume a recent update already covers them.

| Product | Affected versions | Fixed in |
|---|---|---|
| Full Client (Windows, Linux, macOS) | Before 15.83, including 15.82 | 15.83 |
| Windows Portable | Before 15.83 | 15.83 |
| Android Remote Control | Before 15.83 | 15.83 |
| Remote Management add-ons | Six flaws in bulletin TV-2026-1012 | Automatic update |

A companion bulletin, TV-2026-1012, fixes six more flaws in Remote Management add-ons. TeamViewer's same-period bulletin also covers CVE-2026-92372, a screen-image decoding flaw on Linux and macOS, and CVE-2026-92374, which could allow local root on macOS. HackRead reported both.

## How the attack works, and where the proof stops

The attack depends on a connection that a user chooses to make. TeamViewer's statement, as quoted by [HackRead](https://hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/), puts it plainly: "Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host." That sentence explains why this flaw feels different. Most remote-access attacks start with a stolen password or an exposed network port. Here the attacker waits on the other end of a session that the technician starts.

According to Dar's account, exploitation needs no password and no extra click beyond accepting the session. It also works in the default setup, [The Hacker News](https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html) reported. For a help desk that connects to customer machines all day, that leaves a thin margin for error.

The public proof is not a complete network attack, though. Dar's demonstration used a stand-in on the host to supply part of the attack data. Defenders should read the demo as evidence that the bug is real and reachable, not as a finished attack kit.

Who gets hit first? The viewer is the machine under attack, so IT support teams, help desks and managed service providers that connect to customer machines carry the most direct risk. Consumers who let a repair technician into their PC are in scope too. Remote support tools are attractive targets because one compromised technician workstation can reach many client systems. A similar lesson came from [Cisco's SD-WAN flaw CVE-2026-20127](https://usa-24.com/cisco-sd-wan-vulnerability-keydrift/), which was used to steal encryption keys.

Consumers rarely track CVE numbers, so the practical rule is simpler. If someone you did not hire asks to take control of your PC, end the call.

## Is the TeamViewer flaw being exploited yet

Not that the public record shows. TeamViewer said it was unaware of any attacks exploiting the flaw when it published the fix, The Hacker News reported. The company also said it found no evidence of exploitation of the other flaws in the same period, according to HackRead. As of the October 29 listing, CVE-2026-111585 was not in CISA's Known Exploited Vulnerabilities catalog. No in-the-wild attacks appear in the reporting so far.

That makes this a patch-now story rather than a confirmed mass-exploitation story. Compare it with the Drupal Commerce Core flaw CVE-2026-118539, which is [already being exploited](https://usa-24.com/drupal-commerce-vulnerability-exploited/). CISA added CVE-2026-46300, a Linux kernel flaw known as Fragnesia, to its catalog on October 28, according to [CISA](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog).

A separate report involves a different product. Trezor said on October 30 that the report came from a customer in Indonesia. The customer suspected a hardware implant in a Trezor Safe 5 sold by a reseller in Southeast Asia. Trezor has not verified the anomaly, and [TNTmax](https://tntmax.com/teamviewer-vulnerability/) noted that Trezor advises buying hardware wallets only from authorized distributors.

## How to update TeamViewer to 15.83 safely

Start with an inventory. Find every machine that has TeamViewer installed, including portable copies, because the bulletin covers Windows Portable as well. Then work through these steps:

- Check the installed version in the app and confirm it reads 15.83 or later.
- Update Windows, Linux, macOS and Android installs to TeamViewer 15.83 or later.
- Confirm that the automatic update for the Remote Management add-ons (bulletin TV-2026-1012) has installed.
- Download installers only from TeamViewer's official download page, not third-party mirrors. [Cryptika](https://www.cryptika.com/teamviewer-vulnerabilities-could-let-hackers-execute-malicious-code-through-remote-desktop-sessions/) also recommends this.
- Accept remote sessions only from people and hosts you already trust. Treat unexpected support requests, especially pop-ups or unsolicited calls asking you to start a session, as suspicious.

For managed service providers, the rollout is a fleet problem. A technician laptop often holds credentials and sessions for several clients, so a viewer compromised through this flaw could expose whatever that technician touches next. Until every machine is patched, avoid starting sessions to unfamiliar hosts.

TeamViewer releases security updates monthly and includes them for all users, according to [Wikipedia](https://en.wikipedia.org/wiki/TeamViewer). Because the fix shipped on October 27 and 15.82 is also affected, teams that patch only on a monthly schedule should not wait for the next cycle. Turn on automatic updates so the next fix does not depend on someone remembering it.

## What to watch next

Three open questions will decide how serious this gets. The first is whether attackers start using the flaw, which would likely prompt a listing in CISA's catalog. The second is how far the attack reaches without the stand-in on the host, a step Dar's demonstration still relied on. The third is how exposed enterprise deployments were on 15.82 and older releases, a scope the reporting so far does not document.

Watch for changes to CISA's catalog, any new TeamViewer bulletin, and whether Dar publishes more detail on the attack chain. Trezor's unverified implant report is a separate question, and it needs independent verification before it means anything for buyers. For TeamViewer users, the path is short: update to 15.83, confirm the add-ons, and be careful about who gets to connect.

## Frequently asked questions

### Is TeamViewer safe to use after CVE-2026-111585?

TeamViewer is safe to use once it is updated to version 15.83 or later, which fixes CVE-2026-111585. Versions before 15.83, including 15.82 from September 2026, are affected. Until a machine is updated, avoid starting sessions with hosts you do not trust.

### Which TeamViewer version fixes CVE-2026-111585?

Version 15.83 fixes the flaw, and TeamViewer shipped it on October 27, 2026. The companion bulletin TV-2026-1012 fixes six Remote Management add-on flaws through automatic update. Check the installed version on Windows, Linux, macOS and Android.

### Does the TeamViewer attack need a password?

According to researcher Omri Dar's account, exploitation needs no password and no extra click beyond accepting the session. The attack also works in the default setup. The public demonstration still used a stand-in on the host to supply part of the data.

### Is the TeamViewer flaw being exploited in the wild?

Not that the public reporting shows. TeamViewer said it knew of no attacks when it published the fix, and the flaw was not in CISA's Known Exploited Vulnerabilities catalog as of October 29. Treat it as a patch-now issue rather than a confirmed mass-exploitation case.

### Is the Trezor Safe 5 hardware implant confirmed?

No. Trezor said on October 30 that the report came from a customer in Indonesia, and it has not verified the anomaly. Trezor advises buying hardware wallets only from authorized distributors.

## Sources

1. [TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them](https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html)
2. [New TeamViewer Security Flaw Could Turn Routine Remote Support Sessions Into Computer Takeovers](https://cybersecuritynews.com/teamviewer-security-flaw/)
3. [TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff's PCs](https://hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/)
4. [TeamViewer Vulnerabilities Could Let Hackers Execute Malicious Code Through Remote Desktop Sessions](https://www.cryptika.com/teamviewer-vulnerabilities-could-let-hackers-execute-malicious-code-through-remote-desktop-sessions/)
5. [TeamViewer — Wikipedia](https://en.wikipedia.org/wiki/TeamViewer)
6. [TeamViewer Resolved Critical Remote Attack Vulnerability (includes Trezor report)](https://tntmax.com/teamviewer-vulnerability/)
7. [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)