TeamViewer has fixed a bug that lets a remotely controlled computer attack the one controlling it, The Hacker News reported on 30 October. Tracked as CVE-2026-111585, it rates 8.8 on a 10-point scale. Remedio researcher Omri Dar reported it on 14 August, and version 15.83 shipped on 27 October. All earlier versions are affected, including 15.82, in the desktop Full Client, Windows Portable and the Android Remote Control app.
Remedio said the host announces its screen size, and the viewer reserves memory from it. That sum overflows, so too little memory is set aside. The size check uses the announced screen, not the memory reserved, so data lands past the end. This lets the host crash the viewer whenever it likes. On Windows, Remedio beat built-in defenses and ran its own program, with a host-side stand-in supplying part of the attack data. The write-up does not cover other systems. TeamViewer knew of no attacks at release.
Remote-support tools are trusted in one direction: the helped machine is assumed harmless. This flaw reverses that, and the technician only has to accept a session. Leaders should ask which version their support desk runs, and whether technicians connect to machines the company does not manage. TeamViewer lists no workaround, so updating is the fix.