Affected Systems
TeamViewer Full Client (Windows, Linux, macOS), Portable (Windows), and Android Remote Control app, all versions before 15.83. CVE-2026-111585, CVSS 8.8.
Exploitation Status
No active exploitation reported. Proof-of-concept demonstrated by Remedio on Windows with partial code execution. No public exploit code released. Not in CISA KEV catalog as of October 29, 2026.
Business Impact
A compromised or malicious host machine can crash the viewer's TeamViewer client and potentially execute arbitrary code on the viewer's system. Attack requires no password beyond accepting the remote session and works in default configuration. Windows code execution demonstrated; impact on macOS, Linux, and Android unclear but TeamViewer confirms platform-dependent code execution is possible. Affects organizations using TeamViewer for remote support or administration where trust in the remote host cannot be guaranteed.
Urgency
🟠Within 24 hours
Recommended Actions
- Update all TeamViewer Full Client, Portable, and Android Remote Control installations to version 15.83 or later immediately.
- Update TeamViewer Host installations to 15.83 as well, as the same release fixes two additional high-severity flaws affecting Host.
- Review and restrict remote session initiation policies to trusted hosts only, especially for privileged user accounts.
- Monitor TeamViewer session logs for unexpected crashes or abnormal behavior during remote control sessions.
- Apply automatic updates for TeamViewer Remote Management add-ons to address six additional vulnerabilities fixed in bulletin TV-2026-1012.