> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # TeamViewer integer overflow CVE-2026-111585 allows RCE via malicious host - URL: https://f4n6.co.uk/security-feed/teamviewer-integer-overflow-cve-2026-111585-allows-rce-via-malicious-host/ - Published: 2026-10-30T09:45:42.000Z - Updated: 2026-10-30T09:45:42.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-111585, CVE-2026-92372, CVE-2026-92374 ## 1\. Executive summary TeamViewer has patched CVE-2026-111585, an integer overflow in the remote-control screen processing component of its clients on Windows, macOS, Linux and Android, rated CVSS 8.8 HIGH in the NVD record. The flaw is reachable in the default configuration: a viewer (an IT support technician) who accepts a session to an attacker-controlled or compromised host can be made to crash TeamViewer or, per the discovering firm Remedio, to run attacker code on the viewer's machine. CVE-2026-92372 (CVSS 8.8 HIGH, out-of-bounds write in the decoder) and CVE-2026-92374 (CVSS 7.8 HIGH, TOCTOU symlink race on macOS) ship in the same update cycle. None of the three is in CISA KEV and EPSS is 0% for all three, so there is no evidence of exploitation in the wild; TeamViewer states it is not aware of any. The exposure for EMEA financial services is concentrated in service desks and remote-support teams, where a technician's workstation is a high-value foothold into managed estates. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The flaw is triggered from inside an ordinary accepted remote-control session, so a compromise of a support technician's viewer arrives through the firm's own ICT incident surface rather than an external perimeter event. | The incident management process must be able to detect and handle a compromise that originates in a sanctioned remote-support tool, not only in untrusted inbound traffic. | | DORA Art. 28 | TeamViewer is an ICT third-party provider whose client software sits on technician endpoints; the fix is a vendor-supplied client update across Windows, macOS, Linux and Android. | Third-party risk management must track the vendor's patch state and confirm the deployed client version, including legacy builds, against the vendor's fixed release. | ## 3\. Technical analysis & attack chain The vulnerability is an integer overflow (CWE-190) in how a TeamViewer viewer sizes and uses the drawing surface it receives from the host. The host announces the geometry of its screen; the viewer takes those dimensions as-is and allocates an in-memory pixel buffer, then decompresses incoming screen updates into it. No upper bound is enforced on the dimensions that arrive over the network. A host can declare a surface larger than any real screen, for example 32768 by 32768 pixels at 32 bits per pixel, which overflows the 32-bit size calculation, and every row past the 31st is written out of bounds. The decode path that carries this is used only when a hardware video decoder is not available for the session. The host can refuse to negotiate the video codecs, which forces the viewer onto the vulnerable software path. The host therefore controls both the declared surface and the screen updates that overflow the buffer. Confirmed steps, from the source: 1. An attacker controls, or has compromised, a TeamViewer host that a technician will connect to. 2. The technician establishes a remote-control session to that host. This is the only precondition TeamViewer names: "Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host." 3. The host refuses to negotiate the hardware video codecs, pushing the viewer onto the software decode path. 4. The host announces an oversized screen geometry (for example 32768x32768 at 32 bpp) that overflows the 32-bit buffer size. 5. The host sends screen updates that overflow the allocated buffer. At minimum this crashes the viewer repeatedly (denial of service). 6. For code execution, the corrupted surface is a live object the viewer later calls through a pointer held in its first field. Overwriting that pointer redirects the call. Remedio reports it bypassed existing protections to route the call to WinExec and run code in the viewer process. The surface is reachable in the default configuration. An accepted session is all it takes, which is the product's normal mode of operation. The attacker needs no malformed protocol extension: the trigger uses only messages the protocol already supports, from inside an established session. The same update cycle carries two further flaws. CVE-2026-92372 (CVSS 8.8 HIGH, CWE-123) is an out-of-bounds write in the decoder on macOS and Linux: missing destination bounds checking lets crafted screen-image data, or a specially crafted TeamViewer session recording (.tvs) that a user is convinced to open, write past the image buffer and execute arbitrary code. It requires user interaction. CVE-2026-92374 (CVSS 7.8 HIGH, CWE-367) is macOS-only: a TOCTOU race with improper symbolic link handling that lets a low-privileged local attacker install a malicious package and gain root. TeamViewer also patched six high-severity local privilege escalation flaws in the TeamViewer Remote Management add-ons; the source gives no CVE identifiers or technical detail for those six, so they cannot be triaged here beyond "update the add-ons." Confidence caveats. The code-execution chain (pointer overwrite, protection bypass, WinExec) is Remedio's research and is single-sourced; the source does not say whether TeamViewer or an independent party reproduced it. The denial-of-service condition and the vulnerable mechanism are described consistently by both Remedio and TeamViewer's advisory. No exploitation in the wild is reported by TeamViewer, and the NVD, EPSS and CISA KEV positions are consistent with that: not in KEV, EPSS 0%. No threat actor is named in the source and none is attributed here. ## 4\. Mitigation & containment ### P1 (within 24h) - Inventory every TeamViewer client in the estate and identify builds below 15.83 across Full Client, Host, Portable and the Android Remote Control App. Version 15.83 contains the fixes for CVE-2026-111585, CVE-2026-92372 and CVE-2026-92374\. TeamViewer also issued updates for multiple legacy versions; confirm the fixed build for each legacy branch against the vendor advisory before assuming a legacy install is covered. - Update the TeamViewer Remote Management add-ons to the latest version on any endpoint that has them, to close the six local privilege escalation flaws. - Restrict which hosts service-desk technicians may connect to. Where the tooling allows an allowlist of known host IDs, enforce it so a technician cannot accept a session to an arbitrary or unsolicited host. - Treat an unexpected crash of TeamViewer on a technician's machine during or just after a support session as a possible exploitation attempt and preserve the endpoint for review. ### P2 (within 72h) - Remove or block Portable TeamViewer builds on managed endpoints; they bypass software-deployment patching and are named in the affected set. - On macOS, restrict opening of .tvs session recording files to files received through a trusted channel, given CVE-2026-92372's user-interaction requirement via crafted recordings. - Add detection for viewer processes spawning command interpreters or unexpected child processes (see §6), since the reported code-execution path routes through WinExec in the viewer. ### P3 (within 7 days) - Review remote-support session logs for sessions a technician initiated to hosts outside the normal customer or internal set, and for sessions immediately followed by a viewer crash. - Confirm the patched client version is enforced by your software management baseline so new installs and reimages land on 15.83 or the fixed legacy build. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source gives no hashes, network indicators, file paths or command lines. The only file artefact named is the .tvs session recording format, which is a legitimate TeamViewer file type, not an indicator on its own. Behavioural indicators: | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------ | ---------------------------------------------------------- | | Viewer refuses hardware video codec negotiation and falls to software decode during a session to an untrusted host | TeamViewer session/connection logs, endpoint telemetry | Medium (mechanism described by source; no log field named) | | TeamViewer viewer process crashes repeatedly during or after a session | Endpoint OS crash/event logs, EDR process telemetry | Medium | | TeamViewer viewer process spawns a child process via WinExec (for example a command interpreter) | EDR process-creation telemetry | Low (single-sourced to Remedio) | | Low-privileged local user installs a package that gains root on macOS | macOS install logs, EDR | Medium (CVE-2026-92374 mechanism) | ## 6\. Detection The source gives no file hashes, mutexes, registry keys or command-line strings specific to an exploit. It does give distinctive behaviours: a viewer forced off hardware decode, oversized surface dimensions, and viewer-process crashes or child-process creation. A string-based YARA rule would have to key on product names, which detects reporting about the threat rather than the threat, so none is emitted. The Sigma rule below targets the process behaviour the reported code-execution path produces. ```yaml title: TeamViewer Viewer Spawning Command Interpreter (CVE-2026-111585 exploitation) id: 8f2c1a4e-6b7d-4c9e-9a1f-3d5e7c2b9a10 status: experimental description: Detects a TeamViewer viewer process spawning a command interpreter, consistent with the reported WinExec code-execution path for CVE-2026-111585. Single-sourced to Remedio; tune to environment. author: Adverse Trace date: 2026/10/30 references: - https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/ logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - '\TeamViewer.exe' - '\TeamViewer_Service.exe' selection_child: Image|endswith: - '\cmd.exe' - '\powershell.exe' - '\pwsh.exe' condition: selection_parent and selection_child falsepositives: - Legitimate administrative scripts launched by a technician through a support session level: high ``` ## CVE assessment 3 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-111585](https://nvd.nist.gov/vuln/detail/CVE-2026-111585?ref=f4n6.co.uk) | 8.8 High | — | 0% | An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote C… | | [CVE-2026-92372](https://nvd.nist.gov/vuln/detail/CVE-2026-92372?ref=f4n6.co.uk) | 8.8 High | — | 0% | An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version… | | [CVE-2026-92374](https://nvd.nist.gov/vuln/detail/CVE-2026-92374?ref=f4n6.co.uk) | 7.8 High | — | 0% | A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of T… | ## 7\. Sources - SecurityWeek, "TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians' Machines", 2026-10-30\. https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/ - TeamViewer advisory, quoted in the above (no direct URL supplied in the source material). - Remedio research, quoted in the above (no direct URL supplied in the source material). ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-111585 at CVSS 8.8 HIGH as recorded in the NVD, not in CISA KEV, with EPSS at 0%; CVE-2026-92372 at 8.8 HIGH and CVE-2026-92374 at 7.8 HIGH, both also outside KEV at 0% EPSS. There is no evidence of exploitation in the wild and no actor is attributed. The severity is real for a specific population: service-desk and remote-support technicians whose viewer connects to external hosts, because the flaw needs only an accepted session and the code-execution chain, while single-sourced to Remedio, would hand an attacker code running in a trusted support tool. For most EMEA financial services clients the practical action is to confirm the deployed client is 15.83 or the fixed legacy build, update the Remote Management add-ons, and constrain which hosts technicians may reach. Adverse Trace will monitor for a public exploit or a change in KEV or EPSS status on these three CVEs and will reissue if either occurs. --- [Read the original source →](https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*