National CERT Warns of High-Severity TeamViewer Vulnerability (CVE-2026-111585)

Pakistan's National Cyber Emergency Response Team (National CERT) has issued a high-severity warning regarding a vulnerability in the popular remote-control software TeamViewer. The flaw, tracked as CVE-2026-111585, carries a CVSS score of 8.8 and could allow attackers to execute arbitrary code on affected systems.

The vulnerability stems from an integer overflow in the software's processing of remote-control screen data. Successful exploitation could lead to a denial-of-service condition, system crashes, or potentially enable arbitrary code execution with the privileges of the affected viewer process. The flaw affects TeamViewer clients running versions earlier than 15.83 on Windows, Linux, and macOS. TeamViewer Portable for Windows and certain versions of the Android remote-control app are also impacted, while legacy 14.x and 13.x releases have separate security updates.

According to the advisory, TeamViewer version 15.83 or later addresses the vulnerability. Users of the legacy branches should install version 14.7.48868 or 13.2.36231, as applicable. National CERT has urged organizations using TeamViewer for remote access, technical support, and system administration to identify vulnerable installations and immediately upgrade to the latest applicable fixed versions.

The advisory recommends limiting remote-control sessions to approved users and trusted devices, verifying connection requests, reviewing access privileges, and monitoring remote-session records alongside endpoint security alerts. Organizations have also been advised to preserve connection logs, authentication records, and endpoint security data to support investigations into suspicious activity.

Those suspecting a compromise should assess affected devices, restrict or disable remote access where necessary, and seek specialist incident-response assistance if unauthorized code execution is suspected. National CERT emphasized that exploitation requires a remote-control session with an attacker-controlled or compromised host and does not occur automatically.

This warning highlights the importance of timely software updates and robust security practices, especially for organizations relying on remote-access tools for critical operations. Staying vigilant and following National CERT's recommendations can help mitigate the risk posed by this vulnerability.