Three security consultants want a Mac user’s badge, and they only need the user to accept a support call. TeamViewer has rebuilt the code that draws a remote desktop after researchers showed the receiving end of a session could be turned against whoever sits at it.
The problem sits in how a client sizes the pixel buffer holding an incoming screen. A host declares how large its display is, and the viewer trusts that number when it carves out memory to decompress each frame. Nothing caps it. A hostile host can announce a surface no real monitor could reach, make the arithmetic wrap, and push writes past the allocation. Remedio describes an integer overflow rated 8.8, tracked as CVE-2026-111585.
Because the corrupted buffer is a live object the client later calls through, the researchers say they could redirect execution and run code in the viewer. That needs no exploit chain from the target side: accepting the session is the whole precondition, and the faulty decode path is what the client falls back to whenever a host declines to negotiate a hardware decoder.
Windows is where the proof of concept ran, but macOS owners are not bystanders. The same 15.83 release carries CVE-2026-92372, an out-of-bounds write in the screen-image decoder that also fires when someone opens a rigged .tvs recording, and CVE-2026-92374, a symbol-link race that lets a local account slip a package past the checks and reach root. Six more escalations were fixed in the Remote Management add-ons, which ship separately and need their own download.
TeamViewer’s bulletin went out on October 27 and reports no abuse in the field. Legacy branches were refreshed too. On a machine that accepts inbound sessions from outside the company, the person pressing accept is the last line of defense.
