The flaw stems from how the host's screen dimensions are handled: the host announces its screen geometry and the viewer uses those figures to allocate an in-memory pixel buffer for decompressing incoming screen updates, with no upper bound enforced on what arrives over the network. Remedio demonstrated that a host could declare an oversized surface, such as 32768 by 32768 pixels at 32 bits per pixel, overflowing the buffer and writing past its bounds. Because the attacker-controlled host also supplies the screen updates, it can crash the viewer's TeamViewer repeatedly or, as Remedio showed, execute arbitrary code by overwriting a pointer in the corrupted surface, bypassing existing protections.

TeamViewer notes that exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host. Remedio stresses the vulnerable decode path is reachable in the default configuration: a host can refuse to negotiate video codecs, forcing the viewer onto the software decoding path where the bug lives, and an accepted session is all it takes. TeamViewer says it is not aware of any of these vulnerabilities being exploited in the wild.

The same updates fix additional issues. The macOS and Linux updates also address CVE-2026-92372, an out-of-bounds write allowing crafted screen-image data or a malicious TeamViewer session recording file to execute code, requiring user interaction. On macOS, the updates resolve CVE-2026-92374, a race condition with improper symbolic link handling that could let a low-privileged local attacker install a malicious package and gain root privileges. TeamViewer also patched six high-severity local privilege escalation vulnerabilities in its Remote Management add-ons, urging users to update both clients and components.