TeamViewer 15.83 fixes three high-severity client flaws
October 30: The Hacker News says 15.82 left CVE-2026-111585 unfixed, names bulletin TV-2026-1012, reports no workaround, and says it was absent from CISA’s October 29 KEV list.
TeamViewer patched three high-severity client bugs in 15.83 and says it knows of no active exploitation.
TeamViewer’s October 27 bulletin TV-2026-1011 fixes three high-severity flaws in clients used with Remote, Tensor, and ONE. CVE-2026-111585 and CVE-2026-92372, both scored 8.8, can crash a viewer or run code from screen data during a session; the second also via a malicious .tvs file. CVE-2026-92374, scored 7.8, lets a local macOS user become root. TeamViewer said it knew of no exploitation. Canada’s centre lists the Android app before 15.8.3, while other outlets say 15.83. The Hacker News says September’s 15.82 update left CVE-2026-111585 unfixed, there is no workaround, and it was not on CISA’s KEV as of October 29. Bulletin TV-2026-1012 patches six more Remote Management flaws.
- CVE-2026-111585 and CVE-2026-92372 score 8.8; CVE-2026-92374 scores 7.8.
- Fixed builds include 15.83 plus legacy 15.64.10, 14.7.48868, and 13.2.
- CVE-2026-92372 affects Linux and macOS Full Client and needs user interaction.
- Remedio says a host can refuse codecs to force the vulnerable screen path.
- TV-2026-1012 updates six Remote Management add-on flaws automatically.
- TeamViewer reports no known attacks; Remedio published no exploit code.
Timeline
dated events in the reporting · oldest first- Oct 27, 2026TeamViewer publishes bulletin TV-2026-1011 · Cyber Security News
- Oct 28, 2026Canadian centre issues advisory AV26-1093 · Canadian Centre for Cyber Security
- Oct 29, 2026Flaw not listed in CISA’s KEV · The Hacker News
- Oct 30, 2026Remedio details malicious-host screen overflow · SecurityWeek
What each outlet adds
beyond the shared facts- Canadian Centre for Cyber SecurityAdvisory AV26-1093 lists Android before 15.8.3 and names no CVEs.
- Cyber Security NewsGives CVSS scores, affected platforms, and named legacy fix builds.
- SecurityWeekCites Remedio on codec refusal, buffer size, WinExec, and macOS TOCTOU.
- The Hacker NewsSays 15.82 missed the bug, names TV-2026-1012, and notes KEV absence.
Coverage
oldest first · one row per article · UTC- · 2d ago
Canadian Centre for Cyber SecurityFirst report
TeamViewer clients before 15.83 affected by vulnerabilities, Canada warns
Windows, Linux and macOS clients and the Android app before 15.8.3 are listed, with no CVEs named.
- · 2d ago
Cyber Security News
TeamViewer flaws before 15.83 allow code execution in sessions
Three high-severity bugs score up to 8.8, and TeamViewer reported no known active exploitation.
- · 12h ago
SecurityWeek
TeamViewer clients before 15.83 let malicious hosts run code on viewers
CVE-2026-111585 is an integer overflow scored 8.8 and fixed in 15.83; TeamViewer reports no known exploitation.
- · 5h ago
The Hacker News
TeamViewer before 15.83 lets a host attack the viewer (CVE-2026-111585)
A malicious host can crash the viewer and, on Windows, Remedio showed code execution that is not yet fully remote.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111585 | Integer overflow in TeamViewer remote-control screen processing before 15.83 | 8.8 | — | ||
| CVE-2026-92372 | Out-of-bounds write in TeamViewer Linux/macOS screen decoder | 8.8 | — | ||
| CVE-2026-92374 | TOCTOU privilege escalation in TeamViewer macOS helper before 15.83 | 7.8 | — |