A newly disclosed TeamViewer vulnerability lets a remote computer attack the technician or support worker who connects to it. The flaw, tracked as CVE-2026-111585 and rated 8.8 out of 10, is fixed in TeamViewer 15.83. Anyone who uses the software to support customers, coworkers or family members should update now.
What the TeamViewer vulnerability does
The bug is an integer overflow in the screen-decompression component, according to Cybersecurity News and HackRead. The machine being controlled, called the host, can attack the viewer that connected to it. A malicious or compromised host can crash the viewer and, depending on the platform, possibly run code, The Hacker News reported.
This is close to the reverse of the usual remote-access threat model. Most people think of the controlled machine as the one that needs protecting, and the technician's laptop as the safe place to start from. This flaw turns that assumption around, because the viewer is the machine at risk.
TeamViewer shipped the fix in version 15.83 on October 27, 2026. Remedio had notified the company on August 14, and TeamViewer confirmed the issue on October 22. Remedio security researcher Omri Dar published a technical write-up on October 29, and that write-up is what pushed the flaw into the headlines.
Which TeamViewer versions are affected
Bulletin TV-2026-1011 covers the TeamViewer Full Client before 15.83 on Windows, Linux and macOS, along with Windows Portable and Android Remote Control. The Hacker News reports that every version before 15.83 is affected, including 15.82, the September 2026 security update. That detail matters, because many people assume a recent update already covers them.
| Product | Affected versions | Fixed in |
|---|---|---|
| Full Client (Windows, Linux, macOS) | Before 15.83, including 15.82 | 15.83 |
| Windows Portable | Before 15.83 | 15.83 |
| Android Remote Control | Before 15.83 | 15.83 |
| Remote Management add-ons | Six flaws in bulletin TV-2026-1012 | Automatic update |
A companion bulletin, TV-2026-1012, fixes six more flaws in Remote Management add-ons. TeamViewer's same-period bulletin also covers CVE-2026-92372, a screen-image decoding flaw on Linux and macOS, and CVE-2026-92374, which could allow local root on macOS. HackRead reported both.
How the attack works, and where the proof stops
The attack depends on a connection that a user chooses to make. TeamViewer's statement, as quoted by HackRead, puts it plainly: "Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host." That sentence explains why this flaw feels different. Most remote-access attacks start with a stolen password or an exposed network port. Here the attacker waits on the other end of a session that the technician starts.
According to Dar's account, exploitation needs no password and no extra click beyond accepting the session. It also works in the default setup, The Hacker News reported. For a help desk that connects to customer machines all day, that leaves a thin margin for error.
The public proof is not a complete network attack, though. Dar's demonstration used a stand-in on the host to supply part of the attack data. Defenders should read the demo as evidence that the bug is real and reachable, not as a finished attack kit.
Who gets hit first? The viewer is the machine under attack, so IT support teams, help desks and managed service providers that connect to customer machines carry the most direct risk. Consumers who let a repair technician into their PC are in scope too. Remote support tools are attractive targets because one compromised technician workstation can reach many client systems. A similar lesson came from Cisco's SD-WAN flaw CVE-2026-20127, which was used to steal encryption keys.
Consumers rarely track CVE numbers, so the practical rule is simpler. If someone you did not hire asks to take control of your PC, end the call.
Is the TeamViewer flaw being exploited yet
Not that the public record shows. TeamViewer said it was unaware of any attacks exploiting the flaw when it published the fix, The Hacker News reported. The company also said it found no evidence of exploitation of the other flaws in the same period, according to HackRead. As of the October 29 listing, CVE-2026-111585 was not in CISA's Known Exploited Vulnerabilities catalog. No in-the-wild attacks appear in the reporting so far.
That makes this a patch-now story rather than a confirmed mass-exploitation story. Compare it with the Drupal Commerce Core flaw CVE-2026-118539, which is already being exploited. CISA added CVE-2026-46300, a Linux kernel flaw known as Fragnesia, to its catalog on October 28, according to CISA.
A separate report involves a different product. Trezor said on October 30 that the report came from a customer in Indonesia. The customer suspected a hardware implant in a Trezor Safe 5 sold by a reseller in Southeast Asia. Trezor has not verified the anomaly, and TNTmax noted that Trezor advises buying hardware wallets only from authorized distributors.
How to update TeamViewer to 15.83 safely
Start with an inventory. Find every machine that has TeamViewer installed, including portable copies, because the bulletin covers Windows Portable as well. Then work through these steps:
- Check the installed version in the app and confirm it reads 15.83 or later.
- Update Windows, Linux, macOS and Android installs to TeamViewer 15.83 or later.
- Confirm that the automatic update for the Remote Management add-ons (bulletin TV-2026-1012) has installed.
- Download installers only from TeamViewer's official download page, not third-party mirrors. Cryptika also recommends this.
- Accept remote sessions only from people and hosts you already trust. Treat unexpected support requests, especially pop-ups or unsolicited calls asking you to start a session, as suspicious.
For managed service providers, the rollout is a fleet problem. A technician laptop often holds credentials and sessions for several clients, so a viewer compromised through this flaw could expose whatever that technician touches next. Until every machine is patched, avoid starting sessions to unfamiliar hosts.
TeamViewer releases security updates monthly and includes them for all users, according to Wikipedia. Because the fix shipped on October 27 and 15.82 is also affected, teams that patch only on a monthly schedule should not wait for the next cycle. Turn on automatic updates so the next fix does not depend on someone remembering it.
What to watch next
Three open questions will decide how serious this gets. The first is whether attackers start using the flaw, which would likely prompt a listing in CISA's catalog. The second is how far the attack reaches without the stand-in on the host, a step Dar's demonstration still relied on. The third is how exposed enterprise deployments were on 15.82 and older releases, a scope the reporting so far does not document.
Watch for changes to CISA's catalog, any new TeamViewer bulletin, and whether Dar publishes more detail on the attack chain. Trezor's unverified implant report is a separate question, and it needs independent verification before it means anything for buyers. For TeamViewer users, the path is short: update to 15.83, confirm the add-ons, and be careful about who gets to connect.
