Description
An integer overflow in the remote-control
screen processing component of TeamViewer clients (Full Client, Portable and Remote
Control App) prior to version 15.83 may allow a malicious remote host to cause
a denial of service or, depending on the platform, potentially execute
arbitrary code with the privileges of the viewer process. Exploitation requires
a user to establish a remote-control session to an attacker-controlled or
compromised host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TeamViewer | Full Client | < 15.83, 15.64.0 (Legacy Windows 7 & 8) – < 15.64.10 (Legacy Windows 7 & 8), 14.7.0 (Windows) – < 14.7.48868 (Windows), 14.7.0 (Linux) – < 14.7.48868 (Linux), 14.7.0 (macOS) – < 14.7.48868 (macOS), 13.2.0 (Windows) – < 13.2.36231 (Windows), 13.2.0 (Linux) – < 13.2.154008 (Linux), 13.2.0 (macOS) – <… | 15.83 |
| TeamViewer | Portable | < 15.83, 15.64.0 (Legacy Windows 7 & 8) – < 15.64.10 (Legacy Windows 7 & 8) | 15.83 |
| TeamViewer | Remote Control | < 15.83 | 15.83 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
googlesky/CVE-2026-111585 ★ 5 · Oct 31, 2026
CVE-2026-111585 — TeamViewer Remote-Control Screen Decompression Integer Overflow → Heap Buffer Overflow (PoC, fixed in 15.83, CVSS 8.8). Containerized lab + one-command repro with vulnerable/fixed d…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-4193 TeamViewer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026