Most remote-access security advice is written for one direction.

Protect the host. Verify the caller. Don't let strangers in.

CVE-2026-111585 runs the other way.

The host attacks the viewer . The malicious machine is the

one being supported. The target is the support technician's

own workstation.

What happens

The TeamViewer protocol lets the host declare its screen geometry.

The viewer allocates a decompression buffer from those dimensions

— with no upper bound on what arrives over the network.

A host that declares 32768 × 32768 pixels at 32bpp overflows

a 32-bit integer. The allocation wraps. Every row past the

thirty-first is written out of bounds.

The host also controls what gets decompressed into that buffer.

Same attacker, both sides of the write.

The part that makes it deterministic

The vulnerable path only activates when hardware video decoding

isn't available.…