{
  "id": 17252355,
  "title": "CVE-2026-111585: The TeamViewer Host Attacks the Viewer — and the Viewer Is the IT Technician",
  "url": "https://urgent.news/2026/10/30/cve-2026-111585-the-teamviewer-host-attacks-the-viewer-and-the-viewer",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-30T16:25:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/threataft_dev/cve-2026-111585-the-teamviewer-host-attacks-the-viewer-and-the-viewer-is-the-it-technician-a2k"
  },
  "original_language": "en",
  "account": "TeamViewer's Host Attacks Viewer, Creating Catastrophic Security Flaw\n\nRemote-access security guidelines typically focus on protecting the host machine and verifying callers. However, a critical vulnerability, CVE-2026-111585, flips the script. In this case, the host machine becomes the attacker, launching an assault on the viewer, which is usually the support technician's workstation.\n\nWhen TeamViewer establishes a remote control session, the host machine declares its screen geometry. The viewer then allocates a decompression buffer based on those dimensions, without any upper limit. If the host machine declares an excessively large screen size, such as 32768 × 32768 pixels at 32bpp, it triggers a 32-bit integer overflow. The decompression buffer is then written beyond its bounds, allowing the attacker to overwrite memory.\n\nThe vulnerability arises when hardware video decoding is not available. However, the host machine can force the viewer to use software decompression, making the exploitation process deterministic. Researcher Remedio traced the vulnerability to the WinExec function within the viewer process.\n\nWhile the CVE assigns a score of 8.8, this designation may understate the severity of the issue. The attack vector requires only user interaction: establishing a remote-control session to the host machine. For a helpdesk that conducts 40 sessions daily, this interaction could occur on any given Tuesday. The attacker does not even need to own the target machine. A compromised host is sufficient, as any infected endpoint that later opens a support ticket can serve as the delivery mechanism.\n\nThe consequences of a successful attack are far-reaching. If the viewer is compromised, the attacker gains access to everything the compromised machine can reach, including remote monitoring and management (RMM) platforms, password vaults, and standing admin sessions into every customer environment. The blast radius extends to the entire client list.\n\nCVE-2026-111585 is not the only vulnerability associated with TeamViewer. Another flaw, TV-2026-1011, affects the screen-image decoder on Linux and macOS. It allows an out-of-bounds write and can be exploited via a crafted .tvs session recording, even without a live session. Additionally, a time-of-check-to-time-of-use (TOCTOU) race condition in the privileged helper on macOS enables a local low-privileged attacker to escalate privileges to root.\n\nThe vulnerabilities were addressed in version 15.83 of TeamViewer. However, all three issues are fixed in the respective builds. It is crucial to remember that portable installations, which do not appear in software inventories, are often the most overlooked systems.\n\nTo mitigate the risks, treat .tvs session recordings as executable content. More information, including detection guidance and a full bulletin analysis, can be found at the provided link.",
  "summary": "Most remote-access security advice is written for one direction. Protect the host. Verify the caller. Don't let strangers in. CVE-2026-111585 runs the other way. The host attacks the viewer . The malicious machine is the one being supported. The target is the support technician's own workstation. What happens The TeamViewer protocol lets the host declare its screen geometry. The viewer allocates…",
  "key_points": [
    "Host machine becomes attacker in CVE-2026-111585",
    "Viewer allocates decompression buffer based on host's screen geometry",
    "Attack requires only user interaction to establish remote-control session"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}