Threat reportVulnerabilityTL-2026-4976
TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious Hosts Compromise Support Technicians' Viewer Machines
TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious (TL-2026-4976), also tracked as TV-2026-1011, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-11-01. It has no confirmed attribution, affects TeamViewer TeamViewer Full Client (Windows, Linux, macOS), references 9 CVEs (CVE-2026-111585, CVE-2026-92372, CVE-2026-92374), maps to 4 MITRE ATT&CK techniques (T1203, T1204.002, T1219), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 9Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4976
- Threat ID
- TL-2026-4976
- Also known as
- TV-2026-1011, TV-2026-1012
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- it-services, managed-service-providers, helpdesk-and-technical-support, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious
Malware and tooling: TeamViewer, TeamViewer
How TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious works
An integer overflow (CWE-190) in TeamViewer's remote-control screen processing component lets a malicious or compromised host crash the viewer application or potentially execute arbitrary code on the technician's machine from inside an established session. Fixed in version 15.83; TeamViewer reports no active exploitation and no public PoC.
CVE-2026-111585 (CVSS 3.1 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-190) is an integer overflow in the remote-control screen processing (screen decompression) component of TeamViewer clients prior to 15.83. Per SecurityWeek's reporting, the host announces the geometry of the screen and the viewer uses the received dimensions to allocate an in-memory pixel buffer without enforcing upper bounds. A malicious or compromised host can therefore send crafted screen data during an established remote-control session, causing a heap-based buffer overflow in the viewer. The result is a denial of service (crash) or, depending on the platform, arbitrary code execution with the privileges of the viewer process. The attack direction is inverted from the usual remote-support threat model: the target is the support technician's machine, not the endpoint being supported.
Affected products are the TeamViewer Full Client (Windows, Linux, macOS), Portable (Windows) and Remote Control App (Android) prior to 15.83; the NVD record and third-party analysis also list legacy branches 15.64.x, 14.7.x and 13.2.x. Fixes are TeamViewer 15.83 on all platforms, 15.64.10 for legacy Windows 7 and 8, and 14.7.48868 for legacy Linux and macOS. The flaw was reported by Remedio (per SecurityWeek). The bulletin (tv-2026-1011, published 2026-10-27, updated 2026-10-28) states TeamViewer is not aware of active exploitation, and no public proof-of-concept or IOCs have been published. Note: SecurityWeek lists Android among affected platforms; the bulletin text summarized by the vendor page lists Windows, Linux and macOS for the Full Client, Portable and Remote Control App, so verify Android scope against the vendor bulletin.
The same bulletin fixes two further flaws: CVE-2026-92372 (CVSS 8.8, CWE-123, out-of-bounds write in the screen-image decoder on Linux and macOS, reachable via crafted screen data or a malicious session recording) and CVE-2026-92374 (CVSS 7.8, CWE-367, TOCTOU race with symbolic link handling giving local privilege escalation to root on macOS). A companion bulletin, tv-2026-1012, covers six high-severity local privilege escalation flaws (CVSS 7.3-7.8) in Remote Management add-ons (Monitoring, Patch Management, Advanced Asset Management): CVE-2026-92375, CVE-2026-92376, CVE-2026-92377, CVE-2026-111582, CVE-2026-111583 and CVE-2026-111584, involving IPC access control, IPC broker impersonation, DLL sideloading/hijacking and installer race conditions.
Defensive priority: patch all technician-side viewers to 15.83 (or the patched legacy build), inventory legacy and portable copies, and treat connections to untrusted or potentially compromised hosts as a risk to the technician workstation. Monitor TeamViewer client crashes and anomalous child processes spawned by the viewer.
MITRE ATT&CK techniques used in TL-2026-4976
Execution
T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File
Command and Control
stealth
Affected products and versions in TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious
- TeamViewer — TeamViewer Full Client (Windows, Linux, macOS)
Vulnerable versions: < 15.83; 15.64.x; 14.7.x; 13.2.x
Fixed in: 15.83; 15.64.10 (legacy Windows 7/8); 14.7.48868 (legacy Linux/macOS) - TeamViewer — TeamViewer Portable (Windows)
Vulnerable versions: < 15.83
Fixed in: 15.83 - TeamViewer — TeamViewer Remote Control App (Android)
Vulnerable versions: < 15.83
Fixed in: 15.83 - TeamViewer — TeamViewer Host
Vulnerable versions: < 15.83
Fixed in: 15.83 - TeamViewer — Remote Management add-ons (Monitoring Service, Patch Management Service, Advanced Asset Management)
Vulnerable versions: Monitoring < 26.10.1; Patch Management < 26.9.1; Windows Full Client/Host < 15.82 (CVE-2026-92377, CVE-2026-111583)
Fixed in: Monitoring 26.10.1; Patch Management 26.9.1; 15.82
Remediation for TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious
Patches
- TeamViewer 15.83 (Full Client, Host, Portable, Remote Control App for Android)
- TeamViewer 15.64.10 (legacy Windows 7 and 8)
- TeamViewer 14.7.48868 (legacy Linux and macOS)
- Remote Management add-on fixes: Monitoring Service 26.10.1, Patch Management Service 26.9.1 (bulletin tv-2026-1012)
Immediate actions
- Update TeamViewer Full Client, Portable and Remote Control App to 15.83 on all technician workstations
- Inventory and update portable and legacy copies of TeamViewer on support and helpdesk machines
- Avoid starting remote-control sessions to untrusted or potentially compromised hosts until patched
- Do not open untrusted .tvs session recordings with unpatched Linux or macOS clients (CVE-2026-92372)
Workarounds
- No vendor workaround documented; restrict outbound sessions to trusted, managed hosts until patched
Longer-term hardening
- Run technician remote-support tooling on isolated, least-privileged workstations or VDI
- Deploy EDR with alerting on remote-access client crashes and unexpected child processes
- Maintain an approved-version policy and automated update compliance for remote-access software
CVEs associated with TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious
CVE-2026-111585, CVE-2026-92372, CVE-2026-92374, CVE-2026-92375, CVE-2026-92376, CVE-2026-92377, CVE-2026-111582, CVE-2026-111583, CVE-2026-111584
Weaknesses (CWE) in TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious
CWE-190, CWE-123, CWE-367, CWE-284, CWE-287, CWE-732, CWE-269
Timeline of TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious
- Fixed builds made available: 15.83 (all platforms), 15.64.10 (legacy Windows 7/8), 14.7.48868 (legacy Linux/macOS). TeamViewer states it is not aware of active exploitation.
- CVE-2026-111585 record published with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R and CWE-190.
- TeamViewer publishes TV-2026-1012 covering six high-severity local privilege escalation flaws in Remote Management add-ons (CVSS 7.3-7.8).
- TeamViewer publishes security bulletin TV-2026-1011 covering CVE-2026-111585 (integer overflow, CVSS 8.8), CVE-2026-92372 and CVE-2026-92374, fixed in 15.83.
- TeamViewer updates bulletins TV-2026-1011 and TV-2026-1012.
- SecurityWeek reports the flaw, credits researcher Remedio, and notes malicious hosts could compromise technicians' viewer machines.
Sources cited for TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious
Detection coverage for TL-2026-4976
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4976 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.