8.8
HighCVSS 3.1 · from TV
CVE-2026-111585
Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow
Full Client · Integer overflow · CWE-190AffectedFull Client, Portable, Remote Control
FixUpdate to 15.83, 15.64.10 (Legacy Windows 7 & 8), 14.7.48868 (Windows), 14.7.48868 (Linux) or newer
PublishedOct 27, 15:19 · TV
ScoredOct 27 · 8.8 · TV
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
From TV
Affected and fixed versions
ProductAffectedFixed inFull Clientbefore 15.8315.83Full Client15.64.0 (Legacy Windows 7 & 8) – before 15.64.10 (Legacy Windows 7 & 8)15.64.10 (Legacy Windows 7 & 8)Full Client14.7.0 (Windows) – before 14.7.48868 (Windows)14.7.48868 (Windows)Full Client14.7.0 (Linux) – before 14.7.48868 (Linux)14.7.48868 (Linux)Full Client14.7.0 (macOS) – before 14.7.48868 (macOS)14.7.48868 (macOS)Full Client13.2.0 (Windows) – before 13.2.36231 (Windows)13.2.36231 (Windows)Full Client13.2.0 (Linux) – before 13.2.154008 (Linux)13.2.154008 (Linux)Full Client13.2.0 (macOS) – before 13.2.154007 (macOS)13.2.154007 (macOS)Portablebefore 15.8315.83Portable15.64.0 (Legacy Windows 7 & 8) – before 15.64.10 (Legacy Windows 7 & 8)15.64.10 (Legacy Windows 7 & 8)Remote Controlbefore 15.8315.83
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known