Overview
CVE-2026-111582 is a DLL loading vulnerability in the TeamViewer Remote Management Monitoring (RMM) installer for Windows. It affects versions before 26.10.1. A local, authenticated attacker with low privileges can execute arbitrary code with elevated privileges. Exploitation requires user interaction.
NVD published the entry on October 27, 2026, with a CVSS score of 7.3.
Technical Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-111582 |
| CVSS | 7.3 (High) |
| Product | TeamViewer RMM installer for Windows |
| Affected versions | Before 26.10.1 |
| Attack vector | Local, low privileges, user interaction required |
| Impact | Arbitrary code execution with elevated privileges |
Installers that search writable or attacker-influenced locations for DLLs can be tricked into loading a malicious library. When the installer runs with elevated rights, the planted DLL's code inherits them. No active exploitation has been reported in the source data.
Impact
Managed service providers and IT teams that deploy the RMM agent through the installer are the most exposed, since the installer is routinely run with administrative rights on endpoints that standard users can also access.
Remediation
- Update the TeamViewer RMM installer to version 26.10.1 or later and redeploy from the new package.
- Remove old installer copies from shared folders, deployment shares, and user-writable directories.
- Run installers from a protected, admin-only location rather than from folders where standard users can drop files.
- Monitor for unexpected DLLs appearing next to installer binaries.