TeamViewer's October patch fixes three flaws, and the risk falls on whoever starts the session
National CERT's warning concerns one of three flaws fixed in TeamViewer 15.83. The risky direction is the technician who connects out to a host.
Most warnings about remote access software describe an intruder reaching in. The TeamViewer flaw that National CERT flagged runs the other way. The person at risk is the one who opens the connection: a support engineer, an IT contractor or a freelancer who clicks Connect on a machine that turns out to be hostile or already compromised.
National CERT urged Pakistani organisations to move to TeamViewer 15.83 or later, and to update portable and older installations too. The warning, reported on 1 November, followed TeamViewer's own bulletin TV-2026-1011, issued on 27 October and updated on 28 October. The vendor said it knew of no active exploitation in the wild when it published.
Three bugs, one fix
The bulletin lists three vulnerabilities, each rated high. CVE-2026-111585, the one National CERT highlighted, is an integer overflow in remote control screen processing, scored 8.8 out of 10. It affects the Full Client, including the Portable build, on Windows, Linux and macOS, and the Android remote control app. A malicious host can crash the viewer or, depending on the platform, run code with the viewer's privileges. The user must first start a session with that host.
CVE-2026-92372, also scored 8.8, is an out of bounds write in the screen image decoder on Linux and macOS. It can be triggered during a session or by opening a crafted session recording file. CVE-2026-92374, scored 7.8, is a macOS flaw in the installer's privileged helper that could let a low privileged local user gain root. Version 15.83 fixes all three. Older branches are fixed in 14.7.48868 and 13.2.36231 on Windows, and 15.64.10 on the 15.64 Windows branch.
How an overflow becomes a break in
Our reading: in an integer overflow, a size calculation exceeds the largest number its variable can hold and wraps around to a small value. The program then reserves a buffer for the small number and copies the full amount of data into it, writing past the end on the heap. Remote desktop software is a natural place for this class of bug because it has to turn dimensions and pixel data sent by the other side into memory, and it cannot fully trust either.
The bulletin says the user has to start a session with an attacker controlled or compromised host. That makes this partly a social engineering problem. Remote access scams usually target the person being helped. Here the helper is the target, and a technician who connects to many unfamiliar machines has the most exposure.
Platform matters. Windows and Android installations are exposed to the first bug only, Linux to the first two, and macOS to all three, so Mac users have the most to fix. The bulletin does not name the researchers who found the flaws; it says they are credited in the CVE records. Until every copy, including portable ones, is on 15.83, connect only to hosts you have reason to trust.
