Pakistan’s National Cyber Emergency Response Team (National CERT) has warned organizations about a serious security flaw in TeamViewer that could allow hackers to run malicious code on vulnerable computers.

The vulnerability, identified as CVE-2026-111585, carries a severity score of 8.8 out of 10. It is linked to an integer overflow error in how the remote-control software processes screen data.

If successfully exploited, the flaw could crash affected systems, disrupt services or potentially allow attackers to execute arbitrary code with the same privileges as the targeted TeamViewer viewer process.

TeamViewer Users on Windows, Linux and Mac at Risk

The security issue affects TeamViewer clients running versions older than 15.83 on Windows, Linux and macOS.

TeamViewer Portable for Windows and certain versions of the Android remote-control application are also affected. Older TeamViewer 14.x and 13.x releases have separate security updates.

According to National CERT, upgrading to TeamViewer version 15.83 or later addresses the vulnerability.

Users running older versions should install the applicable security updates:

• TeamViewer 14.x: Version 14.7.48868
• TeamViewer 13.x: Version 13.2.36231

National CERT has urged organizations using TeamViewer for remote support, system administration and other remote-access activities to identify vulnerable installations and install the relevant updates immediately.

National CERT Issues Security Recommendations

The advisory also recommends restricting remote-control access to authorized users and trusted devices.

Organizations should verify incoming connection requests, review user permissions and regularly monitor remote-session records alongside endpoint security alerts.

They have also been advised to retain connection logs, authentication records and security data to help investigate suspicious activity.

If an organization suspects that a system has been compromised, it should assess affected devices, restrict or disable remote access where necessary and seek professional incident-response support if unauthorized code execution is suspected.

National CERT clarified that exploiting the vulnerability requires a remote-control session involving an attacker-controlled or compromised host. The flaw does not automatically allow hackers to attack computers without such a session.