Mashhur masofaviy kirish vositasi TeamViewer'dagi yuqori darajadagi zaiflikdan foydalanib, ko'rishchi (IT qo'llab-quvvatlash texniki) tizimini egallab olish mumkin, deb ogohlantiradi Remedio kiberxavfsizlik firmasi.
CVE-2026-111585 (CVSS balli 8,8) sifatida kuzatilgan bu kamchilik Windows, macOS, Linux va Android'dagi TeamViewer mijozlarining masofaviy boshqaruv ekranini qayta ishlash komponentiga ta'sir qiluvchi butun son to'lib ketishi (integer overflow) sifatida tavsiflanadi.
Xavfsizlik kamchiligidan muvaffaqiyatli foydalanish hujumchilarga ko'rishchining TeamViewer'ini ishdan chiqarish yoki ularning tizimida ixtiyoriy kodni bajarish imkonini berishi mumkin.
"Foydalanish uchun foydalanuvchi hujumchi nazoratidagi yoki buzilgan xostga masofaviy boshqaruv seansini o'rnatishi kerak", deb ta'kidlaydi TeamViewer o'z maslahatida.
Remedio aytishicha, muammo xostning ekran o'lchami qanday uzatilishi va ko'rishchida ishlatilishida: xost ekran geometriyasini e'lon qiladi va ko'rishchi qabul qilingan o'lchamlardan foydalanib, xotirada piksel buferini ajratadi, keyin esa u kelayotgan ekran yangilanishlarini dekompressiya qilish uchun ishlatiladi.
Bu dekodlash yuzasi faqat seans uchun apparat video dekoderi mavjud bo'lmasa ishlatiladi, lekin xost video kodeklarini kelishib olishdan bosh tortishi mumkin, shu bilan ko'rishchini shu yo'lga majbur qiladi.
Xost ekranning erisha oladigan o'lchamidan kattaroq yuzani so'rashi mumkin va bu yo'l uni qabul qiladi. Masalan, 32 bit/pikselda 32768 ga 32768 piksel, bu 32 bitni to'ldirib yuboradi, 31 dan keyingi har bir qator chegaradan tashqariga yoziladi.
"Xost e'lon qilgan ekran o'lchamlari chizish yuzasini o'lcham sifatida ishlatadi, tarmoq orqali keladigan narsaga yuqori chegara qo'yilmaydi", deb tushuntiradi Remedio.
Hujumchi nazoratidagi xost e'lon qilingan yuzani ham, buferni to'ldirib yuborishi mumkin bo'lgan ekran yangilanishlarini ham nazorat qiladi, bu esa ko'rishchi ilovasining qayta-qayta ishdan chiqishiga olib keladi.
"Bu shuni anglatadiki, yomon niyatli yoki buzilgan xost oddiy, o'rnatilgan seans ichida, protokol allaqachon qo'llab-quvvatlaydigan xabarlar yordamida xatoni ishga tushirishi mumkin", deb tushuntiradi Remedio.
Oddiy TeamViewer seansi orqali xizmatdan rad etish (DoS) holatini ishga tushirishdan tashqari, Remedio CVE-2026-111585'dan foydalanib, ko'rishchi tizimida ixtiyoriy kodni bajarishi mumkinligini aniqladi.
"Buzilgan yuza — bu ko'rishchi keyinchalik o'zining birinchi maydonidagi ko'rsatkich orqali chaqiradigan jonli obyekt, shuning uchun bu ko'rsatkichni qayta yozish chaqiruvni yo'naltiradi", deb ta'kidlaydi Remedio, bu mavjud himoyalarni chetlab o'tib, chaqiruvni WinExec'ga yo'naltirish va kodni ko'rishchida bajarish imkonini berganini tushuntiradi.
"Yuza standart konfiguratsiyada erishimli. Qabul qilingan seans — bu yetarli, va bu mahsulotning normal ishlash rejimi", deydi kompaniya.
TeamViewer mijozlarining (Full Client, Host, Portable va Android uchun Remote Control App) 15.83 versiyasi zarur tuzatishlarni o'z ichiga oladi. TeamViewer shuningdek, bir nechta eski versiyalar uchun xavfsizlik yangilanishlarini ham chiqardi.
macOS va Linux yangilanishlari shuningdek, CVE-2026-92372'ni ham hal qiladi — bu o'xshash oqibatlarga ega chegaradan tashqari yozish: hujumchi maxsus tayyorlangan ekran-tasvir ma'lumotlarini taqdim etishi yoki foydalanuvchini maxsus tayyorlangan TeamViewer seans yozuvi (.tvs) ni ochishga ishontirishi mumkin, natijada ixtiyoriy kod bajariladi.
"Dekoderda maqsad chegaralari tekshiruvi yo'qligi maxsus tayyorlangan ekran-tasvir ma'lumotlarining tasvir buferiga chegaradan tashqari yozishga olib kelishiga imkon beradi. Foydalanish foydalanuvchi o'zaro ta'sirini talab qiladi", deb ta'kidlaydi TeamViewer.
macOS'da yangilanishlar shuningdek, CVE-2026-92374'ni ham hal qiladi — bu tekshirish vaqti bilan foydalanish vaqti o'rtasidagi (TOCTOU) poyga sharoiti va noto'g'ri ramziy havola ishlov berish kamchiligi bo'lib, past huquqli mahalliy hujumchiga yomon niyatli paketni o'rnatish va root huquqlarini olish imkonini berishi mumkin.
Bundan tashqari, TeamViewer TeamViewer Remote Management qo'shimchalaridagi oltita yuqori darajadagi mahalliy huquqni oshirish zaifliklarini tuzatdi va foydalanuvchilarga mijozlar va komponentlarni eng so'nggi versiyalarga yangilashni tavsiya qiladi.
TeamViewer bu zaifliklardan birortasi yovvoyi tabiatda foydalanilayotgani haqida xabardor emasligini aytadi.
Bog'liq: Adobe, Veeam, Juniper Networks muhim zaifliklarni tuzatdi
Bog'liq: Cisco SD-WAN Zero-Day ekspluatatsiyasi Volt Typhoon'ning "Jim Poyezd" tarmog'iga bog'langan
Bog'liq: Hujumchilar avgustdan beri ikkinchi Cisco Firewall VPN Zero-Day'dan foydalanmoqda
Bog'liq: Xitoylik xakerlar past darajadagi ESXi jurnal yozish kamchiligidan jimgina Zero-Day sifatida foydalangan
A high-severity vulnerability in the popular remote-access tool TeamViewer could be exploited to take over a viewer’s (an IT support technician’s) system, cybersecurity firm Remedio warns.
Tracked as CVE-2026-111585 (CVSS score of 8.8), the flaw is described as an integer overflow affecting the remote-control screen processing component of TeamViewer clients across Windows, macOS, Linux, and Android.
Successful exploitation of the security defect could allow attackers to crash the viewer’s TeamViewer or execute arbitrary code on their system.
“Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host,” TeamViewer notes in its advisory.
The issue, Remedio says, is rooted in how the host’s screen dimension is transmitted and used in the viewer: the host announces the geometry of the screen and the viewer uses the received dimensions to allocate an in-memory pixel buffer it then uses to decompress incoming screen updates.
This decode surface is only used if a hardware video decoder is not available for the session, but the host may refuse to negotiate the video codecs, thus forcing the viewer to that path.
A host can request a surface larger than what a screen can reach, and the path accepts it. An example would be 32768 by 32768 pixels at 32 bits per pixel, which overflows 32 bits, with every row past 31 being written out of bounds.
“The screen dimensions a host announces are used to size the drawing surface as-is, with no upper bound enforced on what arrives over the network,” Remedio explains.
The attacker-controlled host controls both the declared surface and the screen updates that can overflow the buffer, causing the viewer’s application to repeatedly crash.
“That means a malicious or compromised host can trigger the bug from inside an ordinary, established session, using only messages the protocol already supports,” Remedio explains.
In addition to triggering the denial-of-service (DoS) condition over a normal TeamViewer session, Remedio discovered that it could use CVE-2026-111585 to execute arbitrary code on the viewer’s system.
“The corrupted surface is a live object the viewer later calls through a pointer in its own first field, so overwriting that pointer redirects the call,” Remedio notes, explaining that it bypassed existing protections to route the call to WinExec and run the code in the viewer.
“The surface is reachable in the default configuration. An accepted session is all it takes, and that is the product’s normal mode of operation,” the company says.
Version 15.83 of TeamViewer’s clients (including Full Client, Host, Portable, and Remote Control App for Android) contains the necessary patches. TeamViewer also released security updates for multiple legacy versions.
The macOS and Linux updates also resolve CVE-2026-92372, an out-of-bounds write with similar consequences: an attacker could supply crafted screen-image data or convince a user to open a specially crafted TeamViewer session recording (.tvs) to execute arbitrary code.
“Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction,” TeamViewer notes.
On macOS, the updates also resolve CVE-2026-92374, a time-of-check-to-time-of-use (TOCTOU) race condition with improper symbolic link handling flaw that could allow a low-privileged local attacker to install a malicious package and gain root privileges.
Additionally, TeamViewer patched six high-severity local privilege escalation vulnerabilities in the TeamViewer Remote Management add-ons, urging users to update both the clients and the components to the latest versions.
TeamViewer says it is not aware of any of these vulnerabilities being exploited in the wild.
Related:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
Related:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
