Pakistan’s National Cyber Emergency Response Team has urged everyone who uses TeamViewer to update the remote-access program without delay, after a serious flaw was found that could let an attacker crash it or run malicious code on a user’s computer. The warning follows TeamViewer’s own security bulletin and is aimed at home users, office workers and IT support teams alike. The flaw has a severity score of 8.8 out of 10, and the fix is already available in version 15.83. Anyone still running an older version is being told to move to the new release as soon as possible.
TeamViewer is used by support technicians, businesses managing machines in other offices, and people helping a relative from another city. That convenience is what makes a flaw in it so important: a weakness in how screen data is handled can turn a routine support call into a route into the machine that was supposed to be doing the helping.
How the Attack Works
The flaw is tracked as CVE-2026-111585, and it sits in the part of TeamViewer that processes remote screen data. In simple terms, when a remote computer shares its screen, it tells the viewing computer how large that screen image is, so the viewer can set aside enough memory to receive and display it. In this case, a calculation in that process can overflow, meaning the numbers wrap around and the program reserves far less memory than the incoming image actually needs. Screen data that arrives afterwards is then written past the end of that space, corrupting nearby memory and, in the worst case, giving an attacker a foothold on the viewer’s machine.
Researchers at the security firm Remedio, who found the flaw, described the danger plainly: in this attack, the attacker is the host and the victim is the viewer. That reverses the direction most people expect. A malicious or already compromised remote computer can send crafted screen data that triggers the fault, crashing the viewer’s TeamViewer or, depending on the platform, allowing code to run with the same privileges as the program itself.
There is, however, an important limit on the attack. It is not automatic, and it does not strike a computer simply because TeamViewer is installed. It only works when a user actually connects to a computer controlled by an attacker, or to a legitimate computer that has already been compromised. The risk is therefore highest for support staff who connect to many different machines, and for anyone who accepts a session from a stranger.
Which Versions Are Affected
The advisory lists a wide range of TeamViewer products as affected. The TeamViewer Full Client for Windows, macOS and Linux in versions older than 15.83 is affected, as is the TeamViewer Portable edition for Windows and the Android Remote Control app. Users of any of these should move to version 15.83 or later. Older branches of the software, which some organisations keep running for compatibility, have their own separate fixes, including build 14.7.48868 for the 14.x branch and build 13.2.36231 for the 13.x branch, so even users who cannot move to the latest main release should still be able to patch.
The same 15.83 update also fixes two other flaws in TeamViewer’s bulletin, one affecting screen-image decoding on Linux and macOS and another that could allow a local attacker to gain higher privileges on macOS, with a companion update for its Remote Management add-ons. TeamViewer said it was not aware of any attacks exploiting the flaw when it published the fix, and the researchers said they had not observed attacks either and did not release exploit code.
What Users Should Do
National CERT has advised users and organisations to update every TeamViewer installation they control, including portable copies and older versions that are easy to overlook. It has also advised people to accept remote sessions only from verified and trusted people, and to limit remote access to approved users and devices. In an office, that means removing access for staff who no longer need it, and switching on unattended access, which lets someone connect without a person at the other end, only where it is genuinely needed.
Organisations are further advised to review admin privileges linked to remote-access tools and to watch for warning signs such as unexpected crashes or unusual sessions. Where patching cannot be done immediately, the advisory suggests blocking untrusted remote connections as a temporary measure. If a device may already have been compromised, organisations should preserve their logs, restrict remote access at once and seek professional incident-response help.
The warning also fits a wider pattern in Pakistan’s cyber-security work. National CERT, formally announced in March 2024, acts as the country’s central authority for protecting cyberspace and critical infrastructure, issuing advisories and managing incidents. Its message here is one that is often ignored until something goes wrong: keep widely used software up to date, because attackers study public fixes and move quickly against the machines left behind. For TeamViewer users, the practical step could hardly be simpler. Check the version, and if it is older than 15.83, update it now, before the next remote session begins.
