TeamViewer has disclosed CVE-2026-111585, a CVSS 8.8 integer overflow that lets a malicious remote host take over the computer of the support technician connecting to it. The flaw was reported by Remedio and affects TeamViewer clients on Windows, macOS, Linux and Android.
An Integer Overflow in Remote-Control Screen Processing
CVE-2026-111585 sits in the component that processes the remote screen during a remote-control session. A host can announce an oversized screen, for example 32768 by 32768 pixels at 32 bits per pixel. That combination overflows a 32-bit value, so the viewer allocates a pixel buffer that is too small for the data it will receive. Writes then go out of bounds.
The result on the viewer’s machine is either a crash or arbitrary code execution. The direction of the attack is unusual for remote-support software: the host, normally the party seeking help, is the one attacking the technician who responds.
Forcing the Vulnerable Software Decoder Path
The faulty code is used only when no hardware video decoder is available. A malicious host can nonetheless steer the viewer onto that path by refusing codec negotiation, which pushes the session onto the software route where the undersized buffer is allocated. The condition therefore does not shield technicians whose machines normally have hardware decoding.
Who Is Exposed and What Exploitation Requires
Exploitation requires the technician to start a remote-control session to an attacker-controlled or compromised host. The affected side is the viewer, so people who run TeamViewer to connect out to other machines carry the risk. IT support staff and managed service providers that connect to untrusted hosts are exposed.
The source reports no exploitation of the flaw in the wild.
Remote Support Staff as the Target
Support technicians often hold elevated access to the systems they manage. A compromise of a technician’s machine through a rigged session could therefore place an attacker on a device that has credentials or network reach beyond a typical user’s. The reported facts on this point are limited to the technician’s own system being crashed or taken over; the source does not describe any follow-on activity.
TeamViewer’s Fix and Disclosure Details
TeamViewer published an advisory on October 29 or 30 and directs users to update to the fixed version it lists. The source does not identify the specific version number in its summary, so the vendor advisory is the reference for the patched build.
Remedio, the company credited with the discovery, reported the issue. The reporting does not give a timeline of how long TeamViewer had the report before disclosure, or whether other TeamViewer components share the same pattern.
Cross-Platform Scope of the Viewer Flaw
The vulnerable client spans four operating systems: Windows, macOS, Linux and Android. That breadth means a single malicious host could in principle target technicians regardless of their platform, though the exact code paths on each platform are not detailed in the reporting. The common thread is the screen-size handling and the software decoding fallback described in the advisory.
The disclosure gives defenders a specific condition to watch: a remote-control session to a host that is not fully trusted. With no exploitation reported, the exposure so far is theoretical, but the combination of a CVSS 8.8 rating, a cross-platform viewer and an oversized screen announcement makes the mechanism straightforward to describe and, according to the vendor’s advisory, to fix with an update.
TeamViewer Advisory Names the Fix but the Summary Leaves Gaps
TeamViewer’s advisory is the authoritative source for the fixed version, and the public summary of the flaw does not name it. The mechanism carries concrete numbers: a 32768 by 32768 screen at 32 bits per pixel overflows a 32-bit value, so the arithmetic the viewer uses to size its buffer ends up too small. Writes beyond that buffer then land outside it.
Remedio’s report is the origin of the finding, and the reporting does not describe any proof-of-concept release. The CVSS 8.8 rating places the flaw in the high-severity range.
