TeamViewer has fixed a high-severity flaw (CVE-2026-111585) in version 15.83 that lets a malicious or compromised remote computer crash, and in some cases take over, the machine of whoever connects to it. It affects anyone providing remote support, whether your own team or your IT provider. Update every device to 15.83.
Key facts
- CVE-2026-111585, CVSS 8.8 (high): an integer overflow in the component that processes the screen during remote control, according to The Hacker News.
- Affected products: Full Client on Windows, Linux and macOS, the Windows Portable edition and the Android Remote Control app, in all versions before 15.83.
- September's 15.82 is also vulnerable: if you updated then, you are still exposed.
- Timeline: researcher Remedio published the technical details on 29 October and the specialist press picked them up on the 30th.
- No known attacks: TeamViewer was not aware of exploitation when it released the patch, and the flaw was not in CISA's KEV catalog as of its 29 October listing, according to SecurityWeek.
Who is at risk: the one connecting or the one being connected to?
The one connecting. Most people assume the danger lies with the machine receiving support. Here it's the other way round: the flaw affects the "viewer", the computer that takes control of another. All it takes is for the user to start a session to a host that is attacker-controlled or compromised.
According to Remedio, no password or extra clicks are needed, and it works with the default configuration. Remedio demonstrated code execution on the viewer on Windows, bypassing operating system protections. The demo used a stand-in on the host to supply part of the attack data, so it is not yet a complete network attack. It has not been tested on macOS, Linux or Android.
That doesn't mean machines that only receive connections are safe. The same 15.83 release fixes two other high-severity flaws from the same bulletin that do affect the Host, including a code execution bug on Linux and macOS.
Is there any alternative to updating?
No. TeamViewer offers no workaround: the only fix is moving to 15.83 or later. It has also released patches for older versions that are still supported.
If you use the Remote Management add-ons, a parallel bulletin (TV-2026-1012) fixes six more flaws. Those add-ons update automatically, but it's worth checking.
What to do today
- Update every machine that acts as a viewer to 15.83 or later: technicians' laptops, support workstations and Portable installs, which tend to be forgotten on a USB stick or a shared folder.
- Update Host machines too, because the same version fixes two flaws that affect them.
- Email your IT provider or IT manager today and ask whether they have updated their own support machines. Those are the ones connecting to yours.
- Until everything is updated, don't start sessions to machines you don't recognise or that may be compromised.
- Check where TeamViewer is installed and remove it from machines that no longer need it.
What it means for a small business
This flaw flips a comfortable assumption: that the technician connecting is on the safe side. The support person's computer usually holds privileged credentials and has access to many machines. If it falls, the problem is no longer one workstation but the whole network, and sometimes the networks of several clients.
There is no known exploitation and no public code, so there's no need to stop the business. But there is no alternative measure either, and 15.82 has already shown that "I updated recently" isn't enough. Our recommendation: close this out this week, starting with the machines of whoever connects to others.
And use the moment to ask your IT provider an awkward question: which TeamViewer version do they use to connect to your machines, and when did they last update it? If they can't answer quickly, that tells you something. If you want to review how your company handles remote access, our cybersecurity team can help.
Frequently asked questions
I updated to 15.82 in September. Am I protected?
No. 15.82 is also vulnerable. You need 15.83 or later.
Does it affect me if I use TeamViewer on a Mac or Android?
Yes, the macOS Full Client and the Android Remote Control app are on the affected list. Code execution has only been demonstrated on Windows, but that doesn't mean other platforms are safe.
Is it being exploited already?
There is no evidence of attacks. TeamViewer was not aware of exploitation when it released the patch, and Remedio has not published exploit code.
