Remote support has a built-in assumption: the technician's computer is the trusted one, and the computer being helped is the one at risk. A flaw TeamViewer fixed in October turns that around. Connect to the wrong machine, and it can attack you.
What happened
When you take control of a computer with TeamViewer, the remote machine sends a constant stream of screen images to yours, and your copy of TeamViewer decodes them. Remedio found that a remote machine could send crafted data that makes the decoder miscalculate a size and write past the end of its memory. On Windows, Remedio showed this could be turned into running a program of the attacker's choosing on the technician's computer.
The vulnerable code is reachable in a normal session, and the remote machine can force the viewer to use the vulnerable decoding path. All it takes is for the technician to connect to a machine the attacker controls, or one the attacker has already infected.
TeamViewer rated it important rather than critical because it needs that connection to happen, and says it knows of no attacks. A related flaw, CVE-2026-92372, can be triggered by opening a crafted session recording on Linux or macOS. Separately, six flaws in the Monitoring, Patch Management and Asset Management add-ons let someone already on a managed computer raise their privileges to administrator.
Why it matters
Think about who connects to whom. A helpdesk technician, or the IT provider looking after your business, connects to dozens of computers a week, some of them precisely because something is wrong with them. A computer infected with malware is exactly the kind of machine that gets a support session.
If that malware knew how to use this flaw, the support session would carry the infection back to the technician's machine, which is usually the most privileged computer in the building, with saved access to every other system they manage. For an IT provider it could be worse, because their technicians' machines have access to many customers.
The same logic applies to anyone who connects to computers they do not control, such as a bookkeeper helping a client or an employee helping a relative. Remote support is a two-way channel, and both ends need to be up to date.
What to actually do
Update TeamViewer everywhere, starting with the computers that connect to others. The fixed version is 15.83. For Windows 7 and 8, it is 15.64.10, and the 14.7 and 13.2 legacy lines have their own fixed builds listed in TeamViewer's bulletin. TeamViewer's bulletin does not say the main client updates itself, so check the version rather than assuming.
Check the Remote Management add-ons. If you or your IT provider use TeamViewer's Monitoring, Patch Management or Asset Management, those components are updated automatically, but confirm they are on the fixed versions listed in the bulletin.
Ask your IT provider how they protect technician machines. The computers used to support others should be the most tightly controlled in the business: up to date, with endpoint protection, and with no more saved access than they need.
Treat unknown session recordings with care. Do not open TeamViewer recording files from sources you do not trust until your client is updated.
The summary
Nobody has been attacked with this flaw, and the fix is a routine update. It is worth more attention than its "no known exploitation" label suggests, because it breaks an assumption most remote support is built on. The computer you are helping is not necessarily harmless, and the tool you use to help it needs to be as current as anything else you run.
Sources
- Security bulletin TV-2026-1011 — TeamViewer
- Security bulletin TV-2026-1012 — TeamViewer
- CVE-2026-111585 — CVE record
- TeamViewer flaw could let malicious hosts take over support technicians' machines — SecurityWeek
