TeamViewer fixed a flaw that lets a computer you are controlling crash, and possibly take over, your own. Version 15.83 has the fix, and last month's update does not.
TeamViewer, the popular remote-access tool, has fixed a flaw that works backward. Normally the person helping controls the other computer. Here, the computer being controlled can attack the helper's machine. The fix is in version 15.83, and the September update, 15.82, still has the flaw.
In a TeamViewer session, the computer that connects and takes control is called the viewer. The machine being controlled is the host. A malicious or compromised host can use this flaw to crash the viewer's TeamViewer. Depending on the platform, it may also run code on the viewer's computer. It only works after the viewer starts a remote-control session with that host.
The flaw is tracked as CVE-2026-111585 and scored 8.8 out of 10, which is in the high range.
During a session, the host tells the viewer how big its screen image is. The viewer sets aside memory based on that size. The math can overflow and reserve too little space. Screen data that arrives later is then written past the end of it.
Omri Dar, a researcher at security firm Remedio, published a technical account on October 29. He wrote that the attack needs no password and no extra click beyond accepting the session. He also wrote that it works in TeamViewer's default setup.
The affected products are the TeamViewer Full Client on Windows, Linux and macOS, the Windows Portable edition, and the Android Remote Control app. All versions before 15.83 are affected. For this specific flaw, TeamViewer does not list the Host. The same update fixes two other high-severity flaws that do affect the Host, so Host users should still update.
Anyone who does not use TeamViewer is not touched by this.
The risk looks limited for now. TeamViewer said it knew of no attacks when it published the fix. The flaw was not in the US government's catalog of known exploited flaws as of its October 29 listing. Remedio reported no attacks and did not release exploit code.
There are limits to what is known. Remedio showed code execution only on Windows, and the demonstration used a stand-in on the host to supply part of the attack data. So it was not a full attack over the network. Whether the same works on macOS, Linux or Android is not covered. TeamViewer says only that code execution is possible, depending on the platform.
The steps in the alert box above cover the update. The key point is that TeamViewer offers no workaround. Updating is the only fix, so the version number is worth checking on every device that uses the tool, including phones.
Version 15.83 also fixes another code-execution flaw affecting Linux and macOS. A companion bulletin, TV-2026-1012, fixes six more flaws in TeamViewer's Remote Management add-ons. Those updates arrive automatically. Watch for any report of attacks using this flaw, since that would raise the urgency for anyone who has not updated.
Update TeamViewer to version 15.83 or later on every device, because last month's 15.82 is still affected and there is no workaround.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
