Zero Radar
← feed
HighVulnerabilityCVE-2026-111585updated 30 Oct 2026, 19:14 UTC

TeamViewer clients can be crashed or taken over by a malicious remote host

If you connect to a computer that has been hacked or set up by an attacker, that computer can crash your TeamViewer app or, depending on your system, run its own code on your machine. Only the person who starts the remote session is exposed

Fixed in Version 15.83 or later. · out Official, 3 sources
SeverityHighCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 15.83 or later. · since 30 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sets up hostControls a machine you connect to
  2. 2You start a sessionYou connect as the viewer
  3. 3Malicious screen dataHost sends crafted screen updates
  4. 4Viewer overflowsInteger overflow in screen processing
  5. 5Crash or code runsDenial of service or code execution
  6. ResultViewer crashes or attacker runs code

What happened

An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable, and Remote Control App) allows a malicious host to cause denial of service or potentially arbitrary code execution with the viewer process's privileges. Exploitation requires the user to establish a session to an attacker-controlled or compromised host.

Why it is dangerous: A malicious host can crash the viewer or, on some platforms, run code as the viewer's user, which is a concern for support technicians who regularly connect to customer machines.

Are you affected?

You are affected if you run TeamViewer Full Client, Portable, or Remote Control App prior to version 15.83 and connect to remote hosts you do not fully trust.

TeamViewer Full Client, TeamViewer Portable, and TeamViewer Remote Control App, all versions prior to 15.83.

What to do

  1. Update TeamViewer Full Client, Portable, and Remote Control App to version 15.83 or later
  2. Only start remote sessions with hosts you trust, especially unexpected or unknown ones
  3. Be cautious when a remote host asks you to run unfamiliar actions during a session

Timeline

  1. 27 Oct 2026, 16:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 16:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 16:20 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 08:53 UTC
    SecurityWeek reported on it · SecurityWeek
  5. 30 Oct 2026, 19:14 UTC
    The Hacker News reported on it · The Hacker News

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-111585 · ZR-bfec2004
CVSS
8.8 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 16:17 UTC
On Zero Radar
27 Oct 2026, 16:20 UTC (3 min after disclosure)
Last change
30 Oct 2026, 19:14 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

TeamViewer clients can be crashed or taken over by a malicious remote host · Zero Radar