Most remote-access security advice is written for one direction.
Protect the host. Verify the caller. Don't let strangers in.
CVE-2026-111585 runs the other way.
The host attacks the viewer. The malicious machine is the
one being supported. The target is the support technician's
own workstation.
What happens
The TeamViewer protocol lets the host declare its screen geometry.
The viewer allocates a decompression buffer from those dimensions
— with no upper bound on what arrives over the network.
A host that declares 32768 × 32768 pixels at 32bpp overflows
a 32-bit integer. The allocation wraps. Every row past the
thirty-first is written out of bounds.
The host also controls what gets decompressed into that buffer.
Same attacker, both sides of the write.
The part that makes it deterministic
The vulnerable path only activates when hardware video decoding
isn't available. But the host can refuse codec negotiation,
forcing the viewer onto software decompression.
The victim's client doesn't choose the path. The attacker's
machine does.
Researcher Remedio traced the path to WinExec in the viewer
process.
Why CVSS 8.8 undersells this
The vector says UI:R — user interaction required.
The interaction is: establish a remote-control session to the host.
For a helpdesk doing 40 sessions a day, that's Tuesday.
The attacker doesn't even need to own the target machine.
A compromised host is enough — any infected endpoint that
later opens a support ticket becomes the delivery mechanism.
If the viewer is compromised, the attacker inherits everything
it can reach: RMM platform, password vault, standing admin
sessions into every customer environment.
The blast radius is the client list.
Same bulletin, two more flaws
TV-2026-1011 also covers:
-
OOB write in the screen-image decoder (Linux, macOS) —
reachable via a crafted
.tvssession recording. No live session needed. - macOS LPE to root — TOCTOU race in the privileged helper, local low-privileged attacker reaches root.
All three fixed in 15.83.
Fix
| Branch | Fixed build |
|---|---|
| Current | 15.83 |
| 15.64 (Win 7/8) | 15.64.10 |
| 14.7 | 14.7.48868 |
| 13.2 (Win) | 13.2.36231 |
| 13.2 (Linux) | 13.2.154008 |
| 13.2 (macOS) | 13.2.154007 |
Don't forget Portable installs — they don't appear in
software inventory and are the ones most likely to be missed.
Treat .tvs session recordings as executable content.
Full breakdown including detection guidance and the full
bulletin analysis:
👉 https://threataft.com/articles/teamviewer-cve-2026-111585-viewer-heap-overflow-screen-decompression
Top comments (0)