TeamViewer users must update immediately—version 15.83 fixes a serious security vulnerability that allows the computer being controlled (the host) to compromise the one connecting to control it (the viewer). Specifically, this issue can cause TeamViewer on Windows, Linux, macOS, and Android to crash, and in some cases allow attackers to execute arbitrary code on the viewer’s device. The vulnerability, identified as CVE-2026-111585, carries a high severity score of 8.8. It impacts all versions prior to 15.83 of the Full Client, Windows Portable, and Android Remote Control app. Users running the Host should also apply the update, since related flaws affecting the Host were also patched.
How the Flaw Works
A security researcher discovered that during a remote session, the host sends screen size details to the viewer. The viewer allocates memory accordingly—if the host misreports the dimensions, it can trigger an overflow that causes data to be written beyond the buffer’s allocated bounds. At minimum, this can crash the viewer’s TeamViewer client. On Windows, that condition has been chained to bypass OS-level exploit protections and run arbitrary code, though the full exploit (connecting these steps entirely over the network) has not yet been demonstrated. For other platforms, like macOS, Linux, and Android, code execution is considered possible, though not yet fully proven. No password or extra clicks beyond accepting the session are required.
What You Need to Do
TeamViewer has released version 15.83 and strongly urges all users to upgrade from earlier versions. The new release also remedies two additional serious vulnerabilities in the same bulletin—including one or more affecting Linux and macOS Hosts—and fixes multiple flaws in the Remote Management add-ons through a companion update. No workarounds are available.
So far, there are no known cases of the vulnerability being exploited in the wild. It was reported via security researchers, and no exploit code has been published yet. The vulnerability is not listed in any government catalogues of actively exploited bugs.
In short: Any TeamViewer user who establishes remote-control sessions where their machine acts as the viewer is at risk unless running 15.83 or later. The host-side computer could crash the session or worse—run malicious code—in such scenarios.
Security teams should audit their deployed TeamViewer versions immediately, ensure hosts are trusted, and apply the 15.83 update without delay. Because remote access tools are often a critical attack vector, such flaws that allow privilege reversal deserve urgent remediation.
Broader Implications
This vulnerability illustrates a reverse attack vector few anticipate: systems often assume the controlling side (viewer) has full leverage, but here that trust is inverted. As remote work continues to grow, flaws in remote-control tools carry heightened risks—malicious actors could leverage this for targeted offensive operations or supply-chain attacks. Even more concerning is that this kind of bug doesn’t rely on phishing or credential compromise; all it needs is a malicious host and a live session.
What to watch for: whether proof-of-concept code emerges, how quickly threat actors begin targeting this in real attacks, and whether other remote desktop tools share a similar structural exposure. In the meantime, updating TeamViewer and validating the integrity of hosts should be top priorities.
