CVE-2026-111585: The TeamViewer Host Attacks the Viewer — and the Viewer Is the IT Technician

TeamViewer's Host Attacks Viewer, Creating Catastrophic Security Flaw

Remote-access security guidelines typically focus on protecting the host machine and verifying callers. However, a critical vulnerability, CVE-2026-111585, flips the script. In this case, the host machine becomes the attacker, launching an assault on the viewer, which is usually the support technician's workstation.

When TeamViewer establishes a remote control session, the host machine declares its screen geometry. The viewer then allocates a decompression buffer based on those dimensions, without any upper limit. If the host machine declares an excessively large screen size, such as 32768 × 32768 pixels at 32bpp, it triggers a 32-bit integer overflow. The decompression buffer is then written beyond its bounds, allowing the attacker to overwrite memory.

The vulnerability arises when hardware video decoding is not available. However, the host machine can force the viewer to use software decompression, making the exploitation process deterministic. Researcher Remedio traced the vulnerability to the WinExec function within the viewer process.

While the CVE assigns a score of 8.8, this designation may understate the severity of the issue. The attack vector requires only user interaction: establishing a remote-control session to the host machine. For a helpdesk that conducts 40 sessions daily, this interaction could occur on any given Tuesday. The attacker does not even need to own the target machine. A compromised host is sufficient, as any infected endpoint that later opens a support ticket can serve as the delivery mechanism.

The consequences of a successful attack are far-reaching. If the viewer is compromised, the attacker gains access to everything the compromised machine can reach, including remote monitoring and management (RMM) platforms, password vaults, and standing admin sessions into every customer environment. The blast radius extends to the entire client list.

CVE-2026-111585 is not the only vulnerability associated with TeamViewer. Another flaw, TV-2026-1011, affects the screen-image decoder on Linux and macOS. It allows an out-of-bounds write and can be exploited via a crafted .tvs session recording, even without a live session. Additionally, a time-of-check-to-time-of-use (TOCTOU) race condition in the privileged helper on macOS enables a local low-privileged attacker to escalate privileges to root.

The vulnerabilities were addressed in version 15.83 of TeamViewer. However, all three issues are fixed in the respective builds. It is crucial to remember that portable installations, which do not appear in software inventories, are often the most overlooked systems.

To mitigate the risks, treat .tvs session recordings as executable content. More information, including detection guidance and a full bulletin analysis, can be found at the provided link.