Remote Code Execution in TeamViewer

Remedio researcher Omri Dar disclosed CVE-2026-111585, a heap overflow in TeamViewer's viewer. A 32-bit multiply in the CBitmapBuffer constructor wraps, so the allocation is far smaller than the declared screen size, while the RLE decoders check updates only against the declared size. A malicious host can crash the viewer or, per the researchers, achieve code execution despite CFG and DEP, though the demo used a host-side hook for heap grooming. Rated CVSS 8.8, it was fixed in 15.83. Remedio reports the fixed build; only versions up to 15.82 were tested.