The usual TeamViewer warning is about strangers controlling your PC. This flaw runs the other way

Every tech-support scam warning says the same thing: don't let a stranger connect to your computer. This week's TeamViewer bug turns that around. With CVE-2026-111585, the danger is in connecting to a computer someone else controls. Omri Dar of the security firm Remedio, who published the details on 29 October, summed it up in one line: "the attacker is the host and the victim is the viewer."

The flaw sits in how TeamViewer handles the picture of the remote screen. The host tells your copy of TeamViewer how big that image is, your PC sets aside memory based on the figure, and a carefully crafted size makes the calculation overflow so too little gets reserved. The screen data that follows spills past the end. At the very least your TeamViewer crashes, and the host can repeat that at will. On Windows, Remedio got past the system's built-in exploit defences and ran code of its choosing on the viewer's machine, with no password and nothing to click beyond accepting the session. TeamViewer rates it 8.8 out of 10.

So who connects to other people's PCs? The relative who fixes everyone's laptop, for a start, and anyone who helps a friend over TeamViewer. If one of those machines is already infected, the infection now has a route back. TeamViewer says it knew of no attacks when it published bulletin TV-2026-1011 on 27 October, and Remedio hasn't released exploit code. There's no workaround either. If you updated after the September fixes we covered at the time, you're probably on 15.82, which doesn't include this one. Open TeamViewer, go to Help, About, and make sure it says 15.83 or later. Windows 7 and 8 users get a separate build, 15.64.10.

Tendvane's app updates through winget can bring TeamViewer and your other installed programs up to date in one pass, which beats waiting for each of them to nag you.