{"id":"CVE-2026-111585","kind":"vulnerability","aliases":["CVE-2026-111585"],"related":[],"title":"TeamViewer clients: integer overflow in screen processing lets remote host run code","description":"An integer overflow in the remote-control\nscreen processing component of TeamViewer clients (Full Client, Portable and Remote\nControl App) prior to version 15.83 may allow a malicious remote host to cause\na denial of service or, depending on the platform, potentially execute\narbitrary code with the privileges of the viewer process. Exploitation requires\na user to establish a remote-control session to an attacker-controlled or\ncompromised host.","summary":"TeamViewer clients before 15.83 contain an integer overflow in the remote-control screen processing component. A malicious or compromised remote host can cause a denial of service or, depending on the platform, run arbitrary code with the viewer process's privileges.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","package","remote-support","teamviewer","windows"],"not_affected_if":["patched-15.83-or-later"],"how_to_check":"- Open TeamViewer on each workstation and check the version under Help, About TeamViewer, or run the installed client's version query if the sources give one\n- Note whether the install is Full Client, Portable or Remote Control App, since all three are named as affected","fix":"- Update TeamViewer Full Client, Portable and Remote Control App to `15.83` or later\n- Until patched, avoid starting remote-control sessions to hosts you do not fully trust","status":"open","published_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:04+00:00","updated_at":"2026-10-27T16:34:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update TeamViewer Full Client, Portable and Remote Control App to `15.83` or later\n- Until patched, avoid starting remote-control sessions to hosts you do not fully trust","reach":"internet","title":"TeamViewer clients: integer overflow in screen processing lets remote host run code","impact":"high","summary":"TeamViewer clients before 15.83 contain an integer overflow in the remote-control screen processing component. A malicious or compromised remote host can cause a denial of service or, depending on the platform, run arbitrary code with the viewer process's privileges.","category":"package","nicknames":[],"who_cares":["teamviewer","windows","desktop","remote-support"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Viewer process crashes, or code runs with the viewer's privileges","analyst_note":"Check the vendor advisory for exact affected builds per platform and whether code execution is confirmed on each OS; sources give only the NVD text.","how_to_check":"- Open TeamViewer on each workstation and check the version under Help, About TeamViewer, or run the installed client's version query if the sources give one\n- Note whether the install is Full Client, Portable or Remote Control App, since all three are named as affected","needs_analyst":true,"not_affected_if":["patched-15.83-or-later"],"who_is_affected":"Any machine running a TeamViewer client older than 15.83 that starts remote-control sessions is exposed, since the flaw is triggered by screen data from the host being controlled. Exploitation requires a user to establish a session to an attacker-controlled or compromised host, so the risk sits with machines that connect out to others. Systems that only receive remote control from a fully trusted, patched source have less exposure, but the sources do not describe a safe configuration beyond the version.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":3356,"output_tokens":649,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111585':15A,18A '-2026':14A,17A '15.83':29B,92C 'allow':94C 'app':88C 'arbitrari':60B,112C 'attack':135C 'attacker-control':134C 'caus':49B,100C 'client':2A,27B,81C,83C 'code':12A,61B,113C 'compon':41B,78C 'compromis':45B,138C 'contain':30B 'control':38B,75C,87C,130C,136C 'cve':13A,16A 'denial':51B,102C 'depend':55B,106C 'desktop':19B 'establish':126C 'execut':111C 'exploit':121C 'full':82C 'host':10A,47B,98C,139C 'integ':3A,32B,69C 'let':8A 'malici':43B,96C 'may':93C 'overflow':4A,33B,70C 'packag':20B 'platform':58B,109C 'portabl':84C 'potenti':110C 'prior':89C 'privileg':67B,116C 'process':7A,40B,65B,77C,120C 'remot':9A,22B,37B,46B,74C,86C,97C,129C 'remote-control':36B,73C,128C 'remote-support':21B 'requir':122C 'run':11A,59B 'screen':6A,39B,76C 'servic':53B,104C 'session':131C 'support':23B 'teamview':1A,24B,26B,80C 'user':124C 'version':91C 'viewer':64B,119C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Any machine running a TeamViewer client older than 15.83 that starts remote-control sessions is exposed, since the flaw is triggered by screen data from the host being controlled. Exploitation requires a user to establish a session to an attacker-controlled or compromised host, so the risk sits with machines that connect out to others. Systems that only receive remote control from a fully trusted, patched source have less exposure, but the sources do not describe a safe configuration beyond the version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@teamviewer.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111585","severity":null,"published_at":"2026-10-27T16:17:29+00:00","modified_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}