TeamViewer clients: Integer overflow in remote-control screen processing

Summary

An integer overflow in the screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) before version 15.83 can be triggered by a malicious remote host. An attacker can cause a denial of service and, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires that a user establishes a remote-control session to an attacker-controlled or compromised host.

Affected

• TeamViewer Full Client (Windows, Linux, macOS): prior to 15.83
• TeamViewer Portable (Windows): prior to 15.83
• TeamViewer Remote Control App (Android): prior to 15.83
• TeamViewer Host (Windows, Linux, macOS): in scope, as the bulletin lists it with the 15.83 fix
• Legacy branches 15.64 (Windows 7 and 8), 14.7 and 13.2 (see bulletin)

Fixed in

• 15.83 for Full Client, Host, Portable and Remote Control App (Android)
• Legacy: 15.64.10 (Windows 7 and 8); 14.7.48868 (Windows, Linux, macOS); 13.2.36231 (Windows); 13.2.154008 (Linux); 13.2.154007 (macOS)

Workaround

• Unknown. TeamViewer lists no workaround; the only fix is to update.

Exploitation

• TeamViewer was not aware of active exploitation at publication.
• No public proof of concept was found, and the researcher reported no attacks.
• Unverified: a German blog mentions a 'Viewer2Shell' report, but it is not confirmed to relate to this CVE.
• EPSS: 0.29 percent.

Our recommendation

• Update all TeamViewer viewers, including Portable copies and the Android app, to 15.83.
• Update Host installations to 15.83 as well.
• Replace legacy builds with the fixed builds listed in the bulletin.
• Only start sessions to hosts you already trust, and restrict who can initiate sessions.
• Inventory Portable copies, Android installs and legacy installations, since these are easy to miss.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  googlesky/CVE-2026-111585

Research sources

• TeamViewer security bulletin TV-2026-1011 www.teamviewer.com
• The Hacker News: TeamViewer flaw lets remote computers attack viewers thehackernews.com
• Strix CVE record CVE-2026-111585 www.strix.ai
• VulDB entry for the flaw vuldb.com
• HackRead: TeamViewer vulnerability and disclosure timeline hackread.com
• OffSeq Radar: TeamViewer flaw could let malicious hosts take over technicians' machines radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:13.