TeamViewer Flaw: The Hacked Computer Can Now Attack the Person Controlling It

In a TeamViewer session, you'd normally worry about the person taking control. This flaw flips that logic: the controlled machine itself can attack the user who connected to fix it — no password, no extra click, and code execution possible on some platforms.

November 1, 2026 · SunuCyberSecurity Team

Sources: TeamViewer security bulletin TV-2026-1011, NVD, The Hacker News — full list at the end of this article.

On October 27, 2026, TeamViewer released a patch (version 15.83) for three security flaws listed in bulletin TV-2026-1011. The most notable one, tracked as CVE-2026-111585 and scored 8.8 out of 10 in CVSS v3.1, flips the usual remote-access threat model on its head: the danger isn't the person who connects and takes control, but the controlled machine itself, which can attack the user connected to control it.

How the flaw works

In a TeamViewer session, the machine that connects and takes control is called the viewer; the one being controlled is the host. At the start of a session, the host tells the viewer how large the screen image will be, and the viewer uses that value to reserve memory accordingly. The problem (CWE-190, integer overflow): that calculation can overflow and reserve far less memory than needed. Screen data sent afterward by the host is then written past the end of that space — a classic buffer overflow, but triggered by the machine you thought you were in control of, not by the one taking control.

Omri Dar, a researcher at security firm Remedio, published a technical write-up of the flaw on October 29, 2026, summing up the role reversal: "the attacker is the host and the victim is the viewer." At a minimum, this crashes the viewer's TeamViewer session — and the host can trigger that crash again whenever it wants. On Windows, Remedio says it took the demonstration further, bypassing the operating system's built-in exploit defenses to run code of its choosing on the viewer's machine.

Two important caveats, so as not to overstate the exact scope of the demonstration: the Windows proof of concept used a stand-in on the host side to supply part of the attack data, so it isn't yet a fully network-only, end-to-end attack. And the same result hasn't been demonstrated on macOS, Linux, or Android — TeamViewer only says code execution is possible there, "depending on the platform," without further detail. The attack itself needs no password and no extra click beyond accepting the session normally, and works with the software's default setup.

Three flaws fixed in the same patch

Bulletin TV-2026-1011 doesn't fix just one flaw. CVE-2026-111585 (CVSS 8.8, detailed above) affects the Full Client, the Portable edition, and the Android Remote Control app — but, notably, not the Host, as TeamViewer itself points out. The other two flaws in the same bulletin do affect the Host: CVE-2026-92372 (also CVSS 8.8) is a buffer overflow in the screen-image decoder of the Full Client and Host on Linux and macOS, exploitable live during a session or through a crafted .tvs session-recording file, without even opening a live session. CVE-2026-92374 (CVSS 7.8) is a local privilege-escalation flaw on macOS, via a TOCTOU race condition in the privileged installer component — an attacker with limited local access can exploit it to gain root. A complete fix, on both client AND host, means addressing all three.

What we know about exploitation

TeamViewer says it is unaware of any attacks exploiting this flaw as of the patch's release. As of October 29, 2026, it also wasn't listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and Remedio says it observed no real-world attacks and did not release working exploit code.

One point worth keeping in mind despite this relative calm: September 2026's security update (version 15.82) did not fix this flaw — it affects that fairly recent version too. Having applied the latest update available isn't enough to assume you're protected; only version 15.83 (or later) actually fixes all three flaws in the bulletin. TeamViewer offers no temporary workaround — updating is the only protection.

Why this matters for francophone Africa

TeamViewer and similar tools are everywhere for remote IT support in francophone Africa: SMEs relying on a remote provider rather than an in-house IT team, diaspora members fixing relatives' computers back home, technical support for business software or hardware. This use case almost always rests on the same implicit assumption: whoever takes control is in the position of strength, and whoever is controlled is in the position of weakness.

This flaw shows that assumption no longer automatically holds. Anyone connecting to a machine they don't fully control — a client's PC, a new employee's laptop, a device being fixed one-off — should now treat a remote-access session as a two-way exchange of risk, not a one-sided, risk-free act of control for the person exercising it.

Security lessons to take away

Sources and methodology

Official TeamViewer security bulletin TV-2026-1011 (all 3 CVEs, CVSS scores, affected and fixed versions) · NVD, CVE-2026-111585 (CVSS v3.1, CWE-190, affected-version scope) · The Hacker News (reporting, researcher quote from Omri Dar/Remedio, Windows demonstration detail). Patch released by TeamViewer on October 27, 2026; research published by Remedio on October 29, 2026. Data as of November 1, 2026 — no known active exploitation to date; we will update this article if the situation changes.

Related reading

Check your own exposure

A free scan, in minutes, no credit card required.