CVE-2026-111585

TeamViewer lets you remotely view or control another computer's screen, which is common for IT support. This flaw means that if you connect to a computer controlled by an attacker, that attacker could potentially crash your TeamViewer app or, in some cases, take control of it — similar to someone handing you a rigged remote control that backfires when you use it.

This matters to you if your business uses TeamViewer's Full Client, Portable app, or Remote Control App for remote support or access to devices. The risk only applies when you initiate a remote-control session to a host that is malicious or has been compromised — simply running TeamViewer without connecting out does not trigger it.

This is a real but contained risk: there's no evidence of active exploitation and no public exploit code exists, so this isn't an emergency fire drill. Update when you next do routine software maintenance, but don't delay indefinitely since the flaw could allow full code execution if a user connects to a malicious host.

Confirm exposure by inventorying all TeamViewer installations (Full Client, Portable, Remote Control App) and their exact version/platform. Target fixed versions: Full Client 15.83 (current), or 15.64.10 for legacy Windows 7/8, or 14.7.48868 (Windows/Linux/macOS) and 13.2.36231/13.2.154008/13.2.154007 (Windows/Linux/macOS respectively) if staying on older major branches. Portable and Remote Control App should be updated to 15.83 (Portable also offers 15.64.10 for legacy Windows). There is no documented workaround beyond restricting outbound remote-control connections to known-trusted hosts until patched — treat unsolicited remote-control invitations as high risk in the interim. No CISA KEV listing exists, so there is no mandated remediation deadline. Monitor TeamViewer's advisory page and vendor release notes for any escalation to confirmed-exploited status, and re-check EPSS/exploit-code trackers periodically given the 'new' press attention flagged in pulse monitoring.

CVSS 8.8 (High), vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges required, but requires user interaction (initiating a remote-control session). Weakness is CWE-190 (Integer Overflow) leading to a heap-based buffer overflow in screen-decompression logic, with potential for arbitrary code execution at viewer-process privilege level or denial of service, platform-dependent. Not in CISA KEV; no public exploit code on record; EPSS predicts low near-term exploitation likelihood with a flat trend. Exploit maturity is theoretical/PoC-absent at this time; press attention is newly emerging but does not indicate confirmed exploitation.