Advisory · CVE-2026-111585
Integer overflow in TeamViewer remote-control screen processing can execute code from a malicious host
TeamViewer clients (Full Client, Portable, and Remote Control App) before 15.83 contain an integer overflow in the remote-control screen processing component that may allow a malicious remote host to cause denial of service or potentially execute arbitrary code with the viewer's privileges when a user connects to it. CVSS 3.1 8.8.
- Vendor
- TeamViewer
- Product
- TeamViewer
- Identifier / CWE
- CVE-2026-111585
CWE-190 - Action timing
- Immediate
Explain it like I’m five
When you connect to someone else's machine, your client trusts the screen data it receives. A hostile host can send numbers that wrap the client's size math around, corrupting memory in the viewer you are sitting in front of.
- 01Victim connects out
The user establishes a remote-control session to an attacker-controlled or compromised host.
- 02Crafted screen data returned
The malicious host sends screen data designed to trigger the integer overflow.
- 03Processing corrupts
The overflow corrupts the screen processing component's memory handling.
- 04Impact lands
Per TeamViewer, the result is denial of service or, depending on platform, potentially arbitrary code execution with the viewer process's privileges.
What happened
TeamViewer published CVE-2026-111585 on October 27, 2026 in bulletin TV-2026-1011, rated high at CVSS 3.1 8.8: an integer overflow (CWE-190) in the remote-control screen processing component of TeamViewer clients prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
The record lists Full Client and Portable before 15.83 on Windows, Linux, and macOS, the Remote Control app before 15.83 on Android, and the legacy 15.64, 14.7, and 13.2 branches up to their fixed builds in the bulletin, as affected.
What to do
- Inventory TeamViewer Full Client, Host, Portable, and Remote Control app installations and note versions per platform.
- Update clients to 15.83 or later (and legacy branches to the fixed builds in bulletin TV-2026-1011).
- Until updated, advise users to end sessions with unknown hosts and not to open TeamViewer session recordings from untrusted sources.
- Review endpoint telemetry for TeamViewer processes crashing or spawning unexpected processes during or after sessions.
- Verify the running client version after updating, including unattended Host installations.
Management note
Remote access tools are high-value targets because they are trusted by design and present on every endpoint. Keep TeamViewer on the same rapid ring as browsers, and make sure unattended hosts, the easiest installs to forget, are in the count.