A significant security vulnerability in TeamViewer has been identified, posing a risk to technicians who use the software for remote support. Known as CVE-2026-111585, this flaw allows a malicious host to crash the viewer application and potentially execute arbitrary code on the technician’s machine. With a CVSS score of 8.8, the vulnerability is rated as high by TeamViewer.

The vulnerability was unveiled by Remedio researcher Omri Dar, who published the findings on October 29, following a fix that was released on October 27. The attack can occur when a technician connects to an attacker-controlled or compromised host. Once this connection is established, no further actions such as clicking or password entry are necessary for the exploit to proceed.

The flaw exploits the way TeamViewer handles screen data during remote sessions. A malicious host can send specially crafted screen data that leads to a buffer overflow in the viewer’s memory allocation process. This occurs because of a calculation error using 32-bit arithmetic that results in insufficient memory being allocated.

The attack can cause a crash and potentially lead to remote code execution, depending on platform-specific permissions. TeamViewer’s security bulletin TV-2026-1011 highlights that Full Client versions prior to 15.83 on multiple operating systems are affected. Administrators are advised to update to version 15.83 or the latest release to mitigate this risk.

As of the publication of TeamViewer’s bulletin, there were no reports of the vulnerability being actively exploited. However, Remedio disclosed the issue on August 14, emphasizing the need for support teams to prioritize updating their systems before establishing connections to untrusted computers.