The remote support tool most IT teams use to reach a client's desktop can now be turned around and pointed at the technician. TeamViewer has patched a high-severity flaw that lets a malicious host execute code on the machine that connected to it.

What happened

CVE-2026-111585 is an integer overflow, rated 8.8, in the remote-control screen processing component of TeamViewer's Full Client, Portable and Android Remote Control App, in all versions before 15.83. The host announces its screen geometry and the viewer uses those dimensions to size the in-memory pixel buffer it decompresses screen updates into, with no upper bound on what arrives over the network. Declaring a 32768 by 32768 surface at 32 bits per pixel overflows 32 bits and writes every row past 31 out of bounds.

Researcher Remedio, which reported the flaw, showed it goes past a crash. The corrupted surface is a live object the viewer later calls through a pointer in its first field, so overwriting that pointer redirects the call, which they used to reach WinExec and run code in the viewer. The vulnerable path is reachable in the default configuration and only needs an accepted session. TeamViewer says it is not aware of exploitation in the wild. The same releases fix CVE-2026-92372, an out-of-bounds write also reachable through crafted screen-image data or a malicious session recording.

Who is affected

• Every TeamViewer Full Client, Portable and Remote Control App install below 15.83 on Windows, macOS, Linux and Android
• Legacy branches: 15.64.x (Windows 7 and 8) below 15.64.10, 14.7.x below 14.7.48868, 13.2.x below 13.2.36231 on Windows and the matching Linux and macOS builds
• Support desks and MSP technicians who accept inbound sessions to client-supplied or unattended endpoints

What to do now

Patch every TeamViewer client to 15.83 or the fixed legacy build, including the machines technicians use, not just the ones they support.

• Force an update check rather than waiting for a background refresh, and confirm the build number on the technician's own workstation
• Update TeamViewer Remote Management add-ons too, since TeamViewer shipped six high-severity local privilege escalation fixes for them
• Make support staff treat an inbound session request from an unknown or newly onboarded endpoint as untrusted until the client's identity is confirmed by a second channel
• Retire 13.2 and 14.7 clients entirely if you can, rather than patching them

What this means for South African businesses

Most South African SMEs do not run TeamViewer themselves, but their IT provider almost certainly does, which puts the exposure inside the support relationship rather than on the client's own estate. A compromised technician workstation is worse than a compromised desktop in a single company, because that workstation holds saved connections and unattended access into every client. My judgement is that the practical risk here is modest for now, given no reported exploitation, but the blast radius if it is ever used is the entire client base, so the patch belongs on this week's list rather than next month's.

Source: SecurityWeek, reporting TeamViewer advisory TV-2026-1011 and Remedio's research.

Also on the blog

• Ivanti Connect Secure CVE-2026-111357: privilege escalation to root, exploited since 1 October
• National Credit Regulator cyberattack: Auditor-General finds no isolated off-site backups

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.