CVE-2026-111585
HIGH · 8.8 EPSS 0.3%Working PoC demonstrated; urgent patch released; no KEV or in-the-wild confirmation.
What: Integer overflow in TeamViewer remote-control screen processing (Full Client, Portable, Remote Control App < v15.83) enabling DoS or arbitrary code execution; CVSS 8.8.
Why it matters: Researcher (Remedio) demonstrated working code execution on Windows with host-side exploitation; no user interaction beyond accepting session needed. Not KEV-listed yet, but vendor patched urgently (v15.83 released). No confirmed in-the-wild exploitation reported, but attack surface is broad—any technician connecting to untrusted host is at risk.
Where it's seen: Multi-language technical blogs and news sites (Hacker News, CyberSec Guru) amplifying researcher PoC; vendor advisory linking patch; security feeds aggregating. Chatter emphasizes role reversal: attacker as the "help-seeker."
RISK: HIGH — Weaponized PoC public; high CVSS; broad user base; requires only session acceptance.
Description
An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High