The facts

  1. TeamViewer lists Full Client on Windows, Linux and macOS, Windows Portable, and the Android Remote Control app before 15.83 as affected by CVE-2026-111585. Its impact is denial of service or possible code execution with the viewer process's privileges, depending on platform. [1][2]

  2. The attack targets the computer connecting to control another machine. It requires an attacker-controlled or compromised host and an accepted remote-control session; it is not established as an unaided attack on every installed client. [1][2][3]

  3. Remedio demonstrated code execution on Windows, with a host-side hook standing in for part of the delivery. The research did not demonstrate a fully network-delivered exploit or code execution on every other listed platform. [2][3]

  4. The same vendor bulletin covers CVE-2026-92372, a separate Linux/macOS screen-decoder code-execution flaw requiring user interaction, and CVE-2026-92374, a local macOS privilege-escalation flaw. [1]

  5. TeamViewer recommends updating to 15.83 or the latest available release. Its bulletin separately lists fixed maintenance builds for supported older branches. [1]

  6. The vendor said it knew of no active exploitation when publishing the bulletin. The checked CISA catalog, dated 29 October, did not list CVE-2026-111585; that absence does not prove attacks have never occurred. [1][4]

Sources

References support the numbered facts above. Source checks: 30 Oct 2026, 16:29 UTC.

  1. TV-2026-1011: Security Update for Vulnerabilities in TeamViewer Clients

    TeamViewer · Primary source · 27 Oct 2026

    Actual vendor bulletin read, last updated 28 October. All three CVEs, product matrices, session prerequisites, fixed release family and maintenance table were checked. The 111585 matrix is distinct from the companion flaws' Host exposure.

  2. TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

    The Hacker News / Swati Khandelwal · Reporting · 30 Oct 2026

    Actual independent specialist report read. It distinguishes the Windows demonstration's host-side stand-in from a complete network attack and separates possible platform impact from what was tested.

  3. Remote Code Execution in TeamViewer

    Remedio / Omri Dar · Primary source · 29 Oct 2026

    Original research's impact, tested-build table, default-session prerequisite, demonstration limits and disclosure timeline examined. Researcher and vendor are separate parties; no exploit payload or operational attack instructions are reproduced.

  4. Known Exploited Vulnerabilities Catalog, version 2026.10.29

    CISA · Primary source · 29 Oct 2026

    Actual JSON parsed directly on 30 October. Catalog version 2026.10.29, released at 19:09:34 UTC, contains 1,764 entries. Absence is qualified and not a guarantee of no exploitation.

Report a factual error