Loading vulnerability…
Integer overflow in TeamViewer remote-control screen processing
CVE-2026-111585 is an integer overflow in the remote-control screen processing component of TeamViewer Full Client on Windows, Linux, and macOS, Portable on Windows, and the Remote Control App on Android. During screen decompression, specially crafted screen data from a malicious remote host can trigger an integer overflow leading to a heap-based buffer overflow. Affected current-branch versions precede 15.83; affected legacy branches also require maintenance updates. Exploitation requires a user to establish a remote-control session with an attacker-controlled or compromised host and can cause denial of service or, depending on the platform, potentially arbitrary code execution with the viewer process's privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the TeamViewer viewer application, disrupting remote-control sessions. Depending on the platform, memory corruption may permit arbitrary code execution in the viewer process's security context, potentially compromising data and resources accessible to that process. Code execution is not established for every affected platform.
If you can’t patch tonight, do this now.
Until updates are applied, establish remote-control sessions only with trusted hosts and avoid connecting to attacker-controlled or potentially compromised systems. Trust restrictions reduce exposure but do not protect against a trusted host that has been compromised.
Patch, then assume compromise.
Update affected TeamViewer clients to version 15.83 or a later supported release. For installations remaining on legacy branches, apply the corresponding fixed release: 15.64.10 for Windows 7 and Windows 8, 14.7.48868 for Windows, Linux, and macOS, or 13.2.36231 for Windows, 13.2.154008 for Linux, and 13.2.154007 for macOS. Verify all installed affected client variants, including Portable and the Android Remote Control App, rather than updating only the main desktop application.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.