CVE-2026-111585 · TeamViewer remote-control screen integer overflow leading to client…

01 · The Real Story

A booby-trapped share-screen broadcast that hijacks the viewer's living room

An integer overflow in TeamViewer's remote-control screen decoding component affects Full Client, Portable, and Remote Control App versions before 15.83. When a victim uses TeamViewer to view an attacker-controlled or compromised remote desktop, the remote host can feed a specially crafted screen stream that corrupts memory in the viewer process. Successful exploitation can crash the client or execute code with the privileges of the viewer user.

The vendor rates this HIGH at 8.8, but the CVSS vector assumes a network attack surface that does not exist in practice. There is no unauthenticated path to the vulnerable component; the victim must initiate an outbound remote-control session to a hostile endpoint. That interaction requirement, combined with no known active exploitation and an extremely low EPSS, argues for a small downgrade — but the realistic high-value scenario of an IT admin viewer on a privileged workstation keeps this at the HIGH floor.

"TeamViewer's viewer-side integer-overflow bug is triggered by connecting to a malicious or compromised remote host; patch before support techs do."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Control a TeamViewer remote endpoint or lure a victim viewer

The attacker does not send packets directly to the victim. They need a TeamViewer host that will be the remote end of the session — either a purpose-built attacker host advertised as legitimate support, or a compromised end-user machine the victim is about to assist. The victim then connects using the legitimate TeamViewer client.

Conditions required:

Attacker operates a TeamViewer host with a shareable ID/one-time password
Victim has a TeamViewer client older than 15.83
Victim is induced to connect, e.g. via support scam, phishing, or a compromised customer endpoint already in queue

Where this breaks in practice:

Requires social engineering or an existing compromised remote endpoint
Victim must actively initiate the outbound session; inbound firewall rules on the victim do not stop this
TeamViewer traffic is legitimate encrypted remote-control traffic, so edge network controls see normal allowed behavior

Detection/coverage: No scanner identifies a TeamViewer client as vulnerable to CVE-2026-111585. Session initiation is logged locally but rarely centralized.

STEP 02

Victim connects and begins rendering remote screen data

When the victim enters the remote host ID and password, TeamViewer establishes an encrypted session. The vulnerable component is the client-side screen-processing code that unpacks and decodes the remote desktop stream. At this point the attacker has a direct channel to the vulnerable parser.

Conditions required:

Victim provides the remote host ID/password or accepts an incoming connection request
Target viewer version is prior to 15.83
Remote desktop stream starts after session negotiation

Where this breaks in practice:

Users expecting to view a screen receive no warning that the incoming screen data can be malicious
Outbound TeamViewer sessions are generally allowed by perimeter egress policies

Detection/coverage: TeamViewer logs the connection ID and remote host. EDR can see the TeamViewer process start and outbound network connection.

STEP 03

Remote host splices an integer-overflow trigger into the screen stream

The attacker sends crafted frame geometry, tile counts, buffer lengths, or encoded dimensions that cause an integer overflow in the viewer's screen-processing component. The overflow corrupts memory and can lead to controlled code execution or a deterministic crash. Because the payload rides inside the encrypted TeamViewer stream, inline network signatures cannot see it.

Conditions required:

Attacker controls the remote desktop encoder or has tampered with the remote host
Victim's client renders the malicious remote screen data
Exploit reliability must overcome platform-specific memory protections

Where this breaks in practice:

The malicious payload is encrypted inside the TeamViewer protocol
Modern memory protections such as ASLR, CFG, and EDR can reduce exploit reliability
Not every crafted overflow will yield code execution; some attempts only crash the viewer

Detection/coverage: Memory protection features and EDR memory scanners may catch exploitation behavior. Generic TeamViewer traffic is not blocked.

STEP 04

Arbitrary code execution under viewer process context, or client crash

Successful exploitation runs code with the privileges of the TeamViewer viewer process. If the viewer is running as an unprivileged user, impact is limited to a local foothold or denial of service. If the viewer is an IT administrator or MSP technician, the attacker gains full control of that workstation under a privileged account.

Conditions required:

Exploit successfully corrupts memory and hijacks control flow
Viewer process runs as the logged-in user, which may or may not be privileged
No exploit-inhibiting EDR or memory-protection control blocks the post-exploitation payload

Where this breaks in practice:

Windows exploits may be less reliable on the viewer platform mentioned in the advisory
Viewer process may be unprivileged on consumer or kiosk workstations
A crash-only attempt appears as an application error and may not persist

Detection/coverage: Post-exploitation EDR alerts are likely if the attacker drops tools or makes suspicious API calls. A simple crash appears as a TeamViewer application error.

STEP 05

Turn workstation access into domain or fleet impact

For high-value viewers, the attacker can dump credentials, abuse existing privileged sessions, or use legitimate remote support tools to pivot into managed infrastructure. A compromised IT admin workstation with cached domain credentials or active RDP/TeamViewer sessions can be the starting point for domain takeover or mass ransomware deployment.

Conditions required:

Viewer process runs as a privileged domain user or has cached credentials
Victim workstation has network path to managed systems, domain controllers, or client fleets
No credential theft or lateral movement controls such as Credential Guard, LAPS, or network segmentation block the attacker

Where this breaks in practice:

Not every TeamViewer viewer runs privileged; consumer users have limited impact
Credential Guard, LAPS, and local admin restrictions reduce lateral movement
A patient attacker may blend in with legitimate remote support tools, but EDR can detect covert C2 or dumpers

Detection/coverage: EDR should alert on credential dumping and lateral movement. However, attackers often abuse legitimate remote support software already installed across the environment.

03 · Compensating Control

HIGH 7.2→IGNORE 0.0

SEVERITY REDUCED

Upgrade all TeamViewer clients to 15.83 or later immediately — This is the only complete fix. Apply it everywhere TeamViewer Full Client, Portable, or Remote Control App is installed. Deploy within 30 days to meet the noisgate mitigation SLA for HIGH severity, and complete full remediation within 180 days. Override to immediate patch if any active exploitation appears.

HIGH 7.2→MEDIUM 5.5

SEVERITY REDUCED

Restrict TeamViewer outbound sessions to approved partner IDs — Use TeamViewer account policies or network egress filtering to allow only known support partner IDs. This prevents users from connecting to arbitrary attacker-controlled hosts, which is the primary trigger for this vulnerability. Residual risk remains if an approved partner host is compromised.

HIGH 7.2→MEDIUM 4.5

SEVERITY REDUCED

Run TeamViewer viewer in a non-privileged, isolated workstation or VDI — Remove local/domain admin rights from the viewer process and isolate support actions from privileged credentials. This breaks the credential-theft and lateral-movement part of the kill chain even if RCE succeeds. Residual impact becomes a local foothold or DoS rather than domain compromise.

What doesn't work

Inbound firewall rules on the victim do not help, because the victim initiates an outbound connection.
URL filtering and network IPS signatures do not inspect the encrypted TeamViewer screen stream and cannot see the integer-overflow payload.
Antivirus signatures are unlikely to catch a reliable memory-corruption exploit until after code execution begins.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No known active exploitation; not observed in public telemetry or campaign reporting.
Public PoC	No public proof-of-concept identified on GitHub, ExploitDB, or pocindex.io as of this assessment.
EPSS	0.00288 — very low predicted exploitation probability.
CISA KEV	Not listed in the Known Exploited Vulnerabilities catalog.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` — base 8.8, but UI:R and the requirement for a malicious remote host are not captured by the base score.
Affected versions	TeamViewer Full Client, Portable, and Remote Control App before 15.83.
Fixed version	15.83 and later.
Affected component	Client-side remote-control screen processing / decoding component.
Disclosure date	2026-10-27.
Reporting researcher/org	Not named in the available advisory; appears to be a TeamViewer responsible-disclosure bulletin.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (7.2/10)

Why this verdict

Friction audit: the CVSS score assumes a network-reachable unauthenticated service, but in reality the attacker must induce a victim to connect to a malicious or compromised TeamViewer host. That is a large practical narrowing of the exposed population.
Role multiplier: TeamViewer clients are routinely installed on privileged IT support workstations. A compromised remote endpoint can turn a routine support session into RCE on a technician's workstation, which often has domain credentials or pivot paths. The high-value role is plausible and likely represents more than 1% of enterprise installs, so the floor is HIGH.
No observed exploitation: no KEV listing, EPSS 0.00288, and no public PoC keep this from rising to CRITICAL. The vendor 8.8 is defensible in raw CVSS terms but overstates the easy reachability.

Why not higher?

Not CRITICAL because there is no direct unauthenticated network exposure to the vulnerable component. The victim must initiate a remote-control session to an attacker-controlled or already compromised host, which imposes social engineering or prior compromise as prerequisites. Additionally, memory corruption reliability is reduced by modern platform mitigations, and no active exploitation or public exploit exists yet.

Why not lower?

Cannot drop below HIGH because support and admin viewers commonly run from privileged workstations. A successful RCE on that host can expose cached credentials, active sessions, and lateral movement paths to the managed fleet or domain. The patch boundary is clear, but unpatched clients remain an attractive target for malicious remote sessions.

06 · Verification

Crowdsourced verification payload.

Run on each Windows host where TeamViewer may be installed. Invoke with powershell -ExecutionPolicy Bypass -File Check-TeamViewer-CVE-2026-111585.ps1. No administrative privileges are required; it reads installed TeamViewer executable version information. Exit codes: 0 = PATCHED, 2 = VULNERABLE, 1 or other = UNKNOWN.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

$ErrorActionPreference = 'SilentlyContinue'
$minVersion = [version]'15.83'
$paths = @(
  "$env:ProgramFiles\TeamViewer\TeamViewer.exe",
  "${env:ProgramFiles(x86)}\TeamViewer\TeamViewer.exe",
  "$env:LOCALAPPDATA\TeamViewer\TeamViewer.exe",
  "$env:ProgramFiles\TeamViewer\TeamViewer_Service.exe",
  "${env:ProgramFiles(x86)}\TeamViewer\TeamViewer_Service.exe"
)
$found = $false
$vuln = $false
$unknown = $false
foreach ($p in $paths) {
  if (Test-Path $p) {
    $found = $true
    $vi = (Get-Item $p).VersionInfo
    if ($vi -and $vi.FileVersion) {
      $verText = ($vi.FileVersion -replace '[^0-9\.].*$', '')
      try {
        $ver = [version]$verText
        if ($ver -ge $minVersion) {
          Write-Output "PATCHED"
          exit 0
        } else {
          Write-Output "VULNERABLE"
          exit 2
        }
      } catch {
        $unknown = $true
      }
    } else {
      $unknown = $true
    }
  }
}
if ($unknown -or -not $found) {
  Write-Output "UNKNOWN"
  exit 1
}
Write-Output "UNKNOWN"
exit 1