A TeamViewer vulnerability could crash the application or allow arbitrary code execution on a viewer’s machine, including a support technician’s workstation. Exploitation requires the user to connect to a remote machine controlled or compromised by an attacker. Initiating a support session does not remove that risk.

According to Remedio’s warning, as reported by SecurityWeek, CVE-2026-111585 is an integer overflow in the remote desktop display processing component. It has a CVSS score of 8.8 and affects TeamViewer applications on Windows, macOS, Linux and Android.

TeamViewer says it has not observed exploitation of these vulnerabilities in the wild. The article does not confirm that any Vietnamese businesses were affected.

Patches and related vulnerabilities

Version 15.83 contains the necessary fixes for Full Client, Host, Portable and Remote Control App for Android. Updates are also available for some older versions; the applicable releases are listed in TeamViewer bulletin TV-2026-1011.

On macOS and Linux, the update also fixes CVE-2026-92372, an out-of-bounds write that could allow arbitrary code execution through specially crafted screen image data or a specially crafted .tvs session recording.

On macOS, CVE-2026-92374 involves a TOCTOU race condition and improper symbolic link handling. It could let a local attacker with low privileges install a malicious package and gain root privileges. This requires local access, unlike the remote connection scenario above.

TMGS recommendations

TMGS recommends prioritizing technicians’ and administrators’ machines when reviewing exposure:

  • Inventory operating systems, application types and versions, including Portable copies. Apply the appropriate patches and verify installation.
  • Review connections to unfamiliar machines against support requests and the staff who handled them.
  • Investigate application crashes and security alerts on viewer machines. A crash alone is not evidence of exploitation.
  • Verify the origin of .tvs recordings before opening them, particularly on macOS and Linux.
  • Preserve logs, investigate suspicious devices and isolate machines showing signs of compromise under the organization’s incident response procedures.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/lo-hong-teamviewer-de-doa-may-ky-thuat-vien-ho-tro-i.329d2ab9-f04a-477c-8875-7e784740c30e