TeamViewer Full Client CVE-2026-111585

Exploitation requires the victim to establish a remote-control session (as the viewer) to a host that is attacker-controlled or already compromised; the malicious host then supplies crafted data to the viewer's remote-control screen-processing component. The affected software must be a TeamViewer Full Client, Portable, or Remote Control App prior to 15.83 (with branch-specific cutoffs such as 14.7.48868 and 13.2.x backports). Limiting factors: the attack cannot be initiated purely by the remote side - it depends on user interaction (the victim deliberately connecting outbound to the hostile host), so it suits targeted/social-engineering scenarios rather than unsolicited remote compromise; and arbitrary code execution is not guaranteed - the vendor states it is platform-dependent, with denial of service being the baseline impact.

The CVSS base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) looks severe, but the signals must be read against the attack model. AV:N is technically correct, yet the description makes clear the direction of attack is inverted from the usual remote-exploit case: the malicious party is the remote host, and the victim is the viewer that must deliberately establish an outbound remote-control session to that attacker-controlled or compromised host (reflected as UI:R). This is not a mass-scannable, spray-and-pray network bug; it requires a social-engineering or support-scam style setup where the target is induced to connect to the attacker. PR:N is consistent with the attacker needing no privileges on the viewer. No EPSS score, no CISA KEV listing, and no POC/exploit reference are present in the input, so there is no evidence of active exploitation or public exploit code. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a patch-this-cycle posture rather than drop-everything urgency. Note also that code execution is explicitly conditional ('depending on the platform, potentially execute arbitrary code'); the guaranteed outcome is denial of service, while the C:H/I:H/A:H that drives the 8.8 assumes the RCE path, so the full impact is not uniform across all affected platforms - verify per-platform behavior with the vendor bulletin. Net assessment: a genuinely serious client-side flaw worth prompt patching, but real-world risk is gated by the requirement that the victim initiate a session to a hostile host, making targeted rather than widespread exploitation the realistic threat.

An attacker operates or compromises a host running TeamViewer and, via social engineering or a fake support pretext, induces a victim to establish an outbound remote-control session to it. Once the viewer connects, the malicious host returns crafted screen data that triggers the integer overflow in the viewer's remote-control screen processing, crashing the client or, on some platforms, executing code with the privileges of the viewer process. No public exploit identified at time of analysis.