**TeamViewer**, a widely used remote access solution, has addressed a critical flaw that subverts the traditional attack vector in remote sessions. Identified as **CVE-2026-111585**, this vulnerability allows the *controlled machine* (host) to attack the *controlling machine* (viewer), potentially leading to application crashes or even remote code execution. ### The Inverted Attack Vector Typically, security concerns in remote access focus on protecting the host from the viewer. However, this vulnerability flips that dynamic. A malicious or compromised host can exploit **CVE-2026-111585** to cause the viewer's **TeamViewer** client to crash. Depending on the platform, this can escalate to arbitrary code execution on the viewer's computer. This attack is initiated only after a user establishes a remote control session to the compromised host. The fix for this issue is included in **TeamViewer** version 15.83 and later. ### Technical Details of CVE-2026-111585 The flaw, which scores 8.8 out of 10 on the CVSS scale, impacts the **TeamViewer Full Client** on **Windows**, **Linux**, and **macOS**, as well as the **Windows Portable** edition and the **Android Remote Control** app, across all versions prior to 15.83. **Omri Dar**, a researcher at security firm **Remedio**, provided a detailed technical account of the vulnerability on October 29. As Dar explained, "the attacker is the host and the victim is the viewer." The vulnerability stems from how the host communicates its screen image size to the viewer. If this calculation overflows, the viewer allocates insufficient memory, leading to subsequent screen data being written past the end of the reserved space. This, at a minimum, crashes the viewer's **TeamViewer** session and can be repeatedly triggered by the host.  ### Beyond Crashing: Remote Code Execution **Remedio** demonstrated that on **Windows**, they could leverage this bug to bypass operating system exploit defenses and execute arbitrary code on the viewer's system. While the demonstration involved a stand-in on the host side to supply attack data, it showcases the potential for a fully network-borne attack. The write-up did not specify if similar code execution is possible on **macOS**, **Linux**, or **Android**, though **TeamViewer**'s bulletin notes that code execution *is* possible depending on the platform. The attack requires no password or additional clicks beyond accepting the remote session and works with **TeamViewer**'s default configuration. Importantly, this flaw was present in all versions before 15.83, including version 15.82, which was released as a security update in September. This means users who updated last month were still vulnerable. ### Immediate Action Required The only recommended remediation from **TeamViewer** is to update to version 15.83 or later. No workarounds have been provided. Users of the **TeamViewer Full Client**, **Portable** edition, and **Android Remote Control** app are urged to update immediately. Users running the **TeamViewer Host** should also update, as version 15.83 addresses two other high-severity flaws impacting the host. The 15.83 update also resolves two other high-severity vulnerabilities detailed in the same security bulletin, including another code execution flaw affecting **Linux** and **macOS**. A separate companion bulletin, TV-2026-1012, addresses six additional flaws in **TeamViewer**'s **Remote Management** add-ons, delivered via automatic updates. As of the fix's publication, **TeamViewer** stated they were unaware of any active exploitation of this vulnerability. It is not currently listed in **CISA**'s Known Exploited Vulnerabilities catalog, and **Remedio** has not reported any in-the-wild attacks nor released exploit code.