TeamViewer released version 15.83 on October 27, 2026, to address CVE-2026-111585, a high-severity remote-screen processing vulnerability. A malicious or compromised host could exploit the flaw to crash a connecting technician’s viewer or potentially execute code with the viewer’s privileges. TeamViewer rates the vulnerability CVSS 3.1 8.8 (High).
What is the threat?
The flaw is an integer overflow in TeamViewer’s remote-screen processing. When a remote-control session begins, the host sends screen dimensions, called DisplayParams, to the viewer. TeamViewer processes these values in CBitmapBuffer, where incoming screen updates are decompressed.
A malicious host can send crafted values that corrupt the viewer’s memory, potentially crashing TeamViewer or enabling arbitrary code execution. This could allow an attacker to compromise the support technician’s system. Security researcher Omri Dar of Remedio disclosed the issue in an October 29 report.
Why is it noteworthy?
This flaw reverses the typical remote-support risk: the technician connecting to a remote system becomes the target. Help desk and administrator machines often have elevated access, making a compromise a potential entry point into the broader environment.
The affected range also includes TeamViewer 15.82, a security update released in September, meaning systems updated last month may still be vulnerable.
What is the exposure or risk?
Affected products include the TeamViewer Full Client for Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app in versions before 15.83.
Exploitation requires a technician to connect to an attacker-controlled or compromised host. However, it requires no password or additional action beyond accepting the session and works with TeamViewer’s default configuration. This puts MSPs and support teams that regularly connect to customer or user devices at particular risk.
Third-party exposure is also a concern for organizations whose MSPs or suppliers use TeamViewer for remote support. At the time of the fix, TeamViewer reported no known exploitation, and the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalog as of October 29.
What are the recommendations?
Barracuda recommends the following steps to reduce exploitation risk and protect critical infrastructure:
- Patch now. Update TeamViewer clients to version 15.83 or later. TeamViewer lists no workaround, making updating the primary remediation. Fixed builds are also available for older branches, including 15.64.10 for legacy Windows 7 and 8 systems.
- Find outdated installations. Inventory support workstations, Portable copies, Android Remote Control apps, and older installations that may fall outside standard update processes.
- Limit connections. Tie remote sessions to approved support tickets and treat unknown or suspicious endpoints as untrusted.
- Monitor for exploitation. Watch for repeated TeamViewer crashes during sessions, unexpected programs launched by TeamViewer, and connections to previously unseen TeamViewer IDs.
- Reduce the blast radius. Run TeamViewer viewers under standard, non-admin accounts where possible and maintain EDR coverage on support workstations.
- Check third parties. Ask MSPs and suppliers using TeamViewer to confirm they have updated to version 15.83.
References
For more information, review the following resources:
- https://cybersecuritynews.com/teamviewer-security-flaw/
- https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html
- https://hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/#google_vignette
- https://www.rescana.com/post/teamviewer-cve-2026-111585-viewer-screen-overflow-rce
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.