TeamViewer CVE-2026-111585 Allows Host to Trigger Viewer RCE After Session Start
TeamViewer fixed a high-severity host-to-viewer memory corruption bug that enables remote code execution once a session is accepted. The vulnerability survived the prior security update and affects every major platform. Evidence from the discoverer and vendor bulletin shows no active exploitation yet, but the architecture of remote-access software continues to invert trust assumptions between endpoints.
No in-the-wild exploitation is confirmed and the flaw is absent from CISA KEV as of 29 October. The same 15.83 bundle also resolves two additional high-severity issues affecting the Host component on Linux and macOS. Organizations should verify automatic updates reached 15.83 across all client types and audit session logs for unexpected host-initiated terminations that could indicate testing of the overflow condition.
TeamViewer: Within 60 days at least two commercial exploit frameworks will list working modules for CVE-2026-111585 on Windows.
Sources (3)
- [1]TeamViewer Security Bulletin TV-2026-1011(https://www.teamviewer.com/en/security-bulletins/)
- [2]Remedio Technical Write-up on CVE-2026-111585(https://remedio.com/research/teamviewer-host-viewer-overflow/)
- [3]The Hacker News coverage of TeamViewer flaw(https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html)