Press play to start listening
A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician connected to an attacker-controlled device. Once the remote session was established, the attack required no further clicks or theft of the technician’s password.
The now-patched vulnerability affected TeamViewer, a remote-access tool commonly used by corporate help desks to troubleshoot employees’ devices.
Cybersecurity firm Remedio discovered the flaw and shared details of the investigation with Hackread.com. According to Remedio researcher Omri Dar, on an unpatched system, the attack works as soon as the technician accepts the incoming connection.
How the Integer Overflow Works
The vulnerability, tracked as CVE-2026-111585, targets TeamViewer’s screen decompression component. When a session opens, the host transmits screen dimensions called DisplayParams to the viewer. TeamViewer processes these values inside a memory buffer named CBitmapBuffer, where incoming screen updates are decompressed.
The problem lies in how TeamViewer calculates the memory needed to process incoming screen images. The buffer constructor uses 32-bit multiplication to calculate the required memory, but by sending unusually large screen dimensions, such as 32,768 by 32,768 pixels, an attacker can make the calculation produce an incorrect result.
TeamViewer then allocates only around 4 MB of memory but continues processing the image as if it had enough space for the full dimensions. The decoder then checks incoming data against the declared screen dimensions rather than the actual allocated memory. This allows decompressed pixel data to overwrite adjacent heap memory, creating a heap-based buffer overflow.
Remedio demonstrated that the memory corruption could be used to bypass Data Execution Prevention (DEP) and Control Flow Guard (CFG), redirect execution to WinExec and run attacker-controlled code on the technician’s computer.
“Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host,” TeamViewer noted.
TeamViewer Releases Security Updates
Remedio notified TeamViewer’s Product Security team about the flaw on August 14, 2026. TeamViewer confirmed the issue on October 22, assigning it CVE-2026-111585 with a CVSS score of 8.8 (Severity: High).
The fix arrived on October 27 in version 15.83. TeamViewer’s security bulletin also covers two other flaws: CVE-2026-92372, which affects screen-image decoding on Linux and macOS, and CVE-2026-92374, which could allow local attackers to gain root privileges on macOS. They carry CVSS scores of 8.8 and 7.8, respectively.
TeamViewer said it had found no evidence of the flaws being exploited in the wild and advised users to update to the latest version.
Hackread.com has previously reported on attacks in which cybercriminals abused TeamViewer to access company systems. However, this latest discovery is different, as it involves a flaw in TeamViewer itself that allows a computer receiving technical support to attack the technician’s machine.
