The government’s cyber emergency unit, National CERT, has asked TeamViewer users and organisations in Pakistan to move to version 15.83 or later. In an advisory it issued as NCA-25.311026, the government body says older clients can be attacked by the computer at the other end of a remote session.
The bug carries the reference CVE-2026-111585 and a severity score of 8.8 out of 10. It sits in the part of the viewer that handles the remote screen, so the people exposed are those who connect out to another machine. A hostile or already compromised host can send data that crashes TeamViewer or corrupts its memory, and on some platforms that could let it run code with the same rights as the TeamViewer process.
TeamViewer fixed the flaw in version 15.83, released in late October. What is new is that Pakistan’s own authority has now told local users and IT teams to act.
What National CERT wants done
The advisory ranks its actions. Patching comes first, and the organisations it addresses are those that use TeamViewer for remote access, technical support or system administration. After that it suggests:
- limiting remote sessions to approved users, trusted partners and authorised devices, for example through approved IP lists or domain accounts;
- asking staff to confirm who is on the other end before they accept a session;
- working with standard user rights where possible and reviewing unattended access and its permissions;
- blocking untrusted outbound remote connections where an update cannot be installed straight away;
- checking logs for unexpected TeamViewer crashes and for sessions nobody can account for.
If a machine may already have been compromised, the advisory says to keep the connection logs and endpoint alerts, restrict or switch off remote access and consider bringing in incident-response specialists. It adds that these steps support the update and do not replace it.
Which versions are affected
The affected apps are the standard desktop client on Windows, macOS and Linux, the portable Windows build and the Android remote control app. For each of them the cure is 15.83 or whatever is newest. Installations on the older 14.x and 13.x branches have their own fixed builds: the advisory names 14.7.48868 and 13.2.36231, and TeamViewer’s bulletin shows that 13.2.36231 is the Windows build, while 13.2 on Linux and macOS has separate fixed numbers. The advisory points readers to the vendor’s bulletin for other legacy and maintenance releases rather than assuming the normal upgrade path applies.
An attack is not automatic. It needs a user to start a remote-control session with a host the attacker controls, which is why the advisory singles out setups that connect to external or untrusted systems. TeamViewer said at the time of its bulletin that it knew of no exploitation in the wild.
The same bulletin fixes two other bugs
The advisory covers only CVE-2026-111585, but TeamViewer’s bulletin TV-2026-1011 bundles it with two more fixes, also in 15.83. CVE-2026-92372 is an out-of-bounds write in the screen-image decoder on Linux and macOS, and it can also be triggered by opening a crafted TeamViewer session recording (.tvs file). CVE-2026-92374 affects the privileged helper on macOS, where a local user with low rights could slip a malicious installer package past verification and gain root.
National CERT also cites a notice from the Canadian Centre for Cyber Security (AV26-1093) as a second reference, next to the TeamViewer bulletin.
