# TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious Hosts Compromise Support Technicians' Viewer Machines

> An integer overflow (CWE-190) in TeamViewer's remote-control screen processing component lets a malicious or compromised host crash the viewer application or potentially execute arbitrary code on the technician's machine from inside an established session. Fixed in version 15.83; TeamViewer reports no active exploitation and no public PoC.

- **Published:** 2026-11-01T07:54:05Z
- **Last reviewed:** 2026-11-01T07:54:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4976
- **ID:** TL-2026-4976
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111585, CVE-2026-92372, CVE-2026-92374, CVE-2026-92375, CVE-2026-92376, CVE-2026-92377, CVE-2026-111582, CVE-2026-111583, CVE-2026-111584

## Description

CVE-2026-111585 (CVSS 3.1 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-190) is an integer overflow in the remote-control screen processing (screen decompression) component of TeamViewer clients prior to 15.83. Per SecurityWeek's reporting, the host announces the geometry of the screen and the viewer uses the received dimensions to allocate an in-memory pixel buffer without enforcing upper bounds. A malicious or compromised host can therefore send crafted screen data during an established remote-control session, causing a heap-based buffer overflow in the viewer. The result is a denial of service (crash) or, depending on the platform, arbitrary code execution with the privileges of the viewer process. The attack direction is inverted from the usual remote-support threat model: the target is the support technician's machine, not the endpoint being supported.

Affected products are the TeamViewer Full Client (Windows, Linux, macOS), Portable (Windows) and Remote Control App (Android) prior to 15.83; the NVD record and third-party analysis also list legacy branches 15.64.x, 14.7.x and 13.2.x. Fixes are TeamViewer 15.83 on all platforms, 15.64.10 for legacy Windows 7 and 8, and 14.7.48868 for legacy Linux and macOS. The flaw was reported by Remedio (per SecurityWeek). The bulletin (tv-2026-1011, published 2026-10-27, updated 2026-10-28) states TeamViewer is not aware of active exploitation, and no public proof-of-concept or IOCs have been published. Note: SecurityWeek lists Android among affected platforms; the bulletin text summarized by the vendor page lists Windows, Linux and macOS for the Full Client, Portable and Remote Control App, so verify Android scope against the vendor bulletin.

The same bulletin fixes two further flaws: CVE-2026-92372 (CVSS 8.8, CWE-123, out-of-bounds write in the screen-image decoder on Linux and macOS, reachable via crafted screen data or a malicious session recording) and CVE-2026-92374 (CVSS 7.8, CWE-367, TOCTOU race with symbolic link handling giving local privilege escalation to root on macOS). A companion bulletin, tv-2026-1012, covers six high-severity local privilege escalation flaws (CVSS 7.3-7.8) in Remote Management add-ons (Monitoring, Patch Management, Advanced Asset Management): CVE-2026-92375, CVE-2026-92376, CVE-2026-92377, CVE-2026-111582, CVE-2026-111583 and CVE-2026-111584, involving IPC access control, IPC broker impersonation, DLL sideloading/hijacking and installer race conditions.

Defensive priority: patch all technician-side viewers to 15.83 (or the patched legacy build), inventory legacy and portable copies, and treat connections to untrusted or potentially compromised hosts as a risk to the technician workstation. Monitor TeamViewer client crashes and anomalous child processes spawned by the viewer.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.002 User Execution: Malicious File
- T1219 Remote Access Tools
- T1574.001 Hijack Execution Flow: DLL
- T1574.001 Hijack Execution Flow: DLL

## Sources

- [TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians' Machines (SecurityWeek)](https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/)
- [TeamViewer Security Bulletin TV-2026-1011](https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/)
- [TeamViewer Security Bulletin TV-2026-1012](https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/)
- [NVD - CVE-2026-111585](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-111585)
- [TeamViewer vulnerabilities patched (TV-2026-1011) - SecurityOnline](https://securityonline.info/teamviewer-vulnerabilities-patched-tv-2026-1011/)
- [CVE-2026-111585 - OpenCVE](https://app.opencve.io/cve/CVE-2026-111585)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4976