The Remote Session That Bites Back: A TeamViewer Flaw Could Let a Rigged Computer Take Over the Technician Connecting to It
TeamViewer has fixed CVE-2026-111585, a high-severity flaw that could let a malicious or compromised computer crash or run code on the machine of the support technician connecting to it. Here are the key facts, the related fixes and an update checklist for anyone who uses remote support tools.
Remote support normally carries risk in one direction: the technician has control and the customer’s computer is the one exposed. A newly patched TeamViewer flaw flips that around. Under the right conditions, the computer being supported could attack the person supporting it.
The facts below come from SecurityWeek’s report on the TeamViewer vulnerabilities.
Fact file: CVE-2026-111585
- Severity: CVSS score of 8.8 (high).
- Type of bug: an integer overflow in the part of TeamViewer that processes the remote screen image during a remote control session.
- Platforms: Windows, macOS, Linux and Android versions of TeamViewer.
- Who is at risk: the viewer side, meaning the person or technician connecting in. The attack comes from a malicious or compromised host computer on the other end.
- Possible impact: crashing the viewer or running code on the technician’s machine. Remedio says the vulnerable code is reachable in the default configuration and that an accepted session is all it takes.
- Found by: security firm Remedio.
- Fixed in: TeamViewer 15.83, with updates also released for legacy versions.
- Exploited? TeamViewer says it is not aware of any attacks using these flaws.
Why the direction matters
A support technician or managed service provider may connect to dozens of customer computers in a week. If any one of them has already been compromised, this flaw could let the attacker on that machine jump to the technician’s computer, which often holds access to many other systems. That makes the technician’s machine a valuable stepping stone.
The other fixes in the same batch
- CVE-2026-92372: an out-of-bounds write affecting macOS and Linux that could be triggered by crafted screen data or a specially made .tvs session recording file.
- CVE-2026-92374: a macOS timing flaw involving symbolic links that could let a local user gain root, the highest level of access.
- Six more high-severity issues in TeamViewer’s Remote Management add-ons that could let a local user raise their privileges.
Update checklist
- List every computer that has TeamViewer installed, including old installs on staff laptops and home machines used for work.
- Update to version 15.83 or the patched legacy release for your version.
- Update the Remote Management add-ons if you use them.
- Do not open .tvs session recording files from sources you do not trust.
- Remove TeamViewer from machines that no longer need it.
What this means for your company
Whichever remote support tool you use, it is one of the most powerful pieces of software in your environment, and it deserves fast patching and a clear owner. If an outside IT provider connects to your computers, ask how they keep their remote tools up to date and how they protect their own technicians’ machines. If your own staff provide support, keep their workstations separate from everyday browsing and email, and give them only the access they need.
Would you like a second set of eyes on the remote access tools installed across your company? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
