TeamViewer published security bulletin TV-2026-1011 on 27 October 2026 (last updated 28 October), rated Important with CVSS scores up to 8.8 (High), fixing three flaws in TeamViewer clients in version 15.83.

TeamViewer says CVE-2026-111585 (CVSS 3.1 8.8) is an integer overflow in the remote-control screen processing of the Full Client, Portable and Remote Control App before 15.83 that may let a malicious remote host cause a denial of service or, depending on the platform, potentially execute arbitrary code with the viewer's privileges; exploitation requires a user to start a remote-control session to an attacker-controlled or compromised host.

The bulletin also fixes CVE-2026-92372 (CVSS 8.8), an out-of-bounds write in the screen-image decoder of the Full Client for Linux and macOS that can allow remote code execution through crafted screen-image data in a session or a crafted .tvs session recording, and CVE-2026-92374 (CVSS 7.8), a race condition in the macOS privileged helper of the Full Client and Host that can give a local low-privileged attacker root.

TeamViewer says it was not aware of active exploitation at the time of publication. Researcher Remedio, which reported CVE-2026-111585, says the attack works in the default configuration once the session is accepted, and that on Windows it went from a repeatable crash to running code of its choosing in the viewer.

The Hacker News reported on 30 October that Remedio's demonstration used a stand-in on the host for part of the attack data and that Remedio released no exploit code.

A companion bulletin, TV-2026-1012, fixes six local privilege escalation flaws (up to CVSS 7.8) in TeamViewer's Remote Management add-ons. (sources: TeamViewer; Remedio; The Hacker News)