TeamViewer Patches Three High-Severity Vulnerabilities in Client Software

TL;DR

TeamViewer published security bulletin TV-2026-1011 on October 27, 2026, addressing three high-severity TeamViewer vulnerabilities across Windows, macOS, Linux, and Android clients. These flaws allow attackers to execute arbitrary code via crafted screen data or escalate local privileges to root on macOS. Users and administrators must update their installations to version 15.83 or the latest legacy builds immediately.

Why It Matters

TeamViewer is a remote access and support platform installed on more than 2.5 billion devices worldwide,according to company figures. Consequently, security flaws in remote desktop clients expose both IT administrators and enterprise endpoints to severe compromise.

TeamViewer has released security updates addressing several vulnerabilities affecting TeamViewer Clients. Furthermore, the vendor confirms that “At the time of publication, TeamViewer is not aware of any active exploitation in the wild.” In addition, no public proof-of-concept exploit code has been confirmed.

How the Attack Works

The three TeamViewer vulnerabilities involve memory corruption in screen processing and insecure package handling.

Remote Code Execution in Screen Processing

First, CVE-2026-92372 (CVSS 8.8) is an out-of-bounds write flaw (CWE-123) in the screen-image decoder for Linux and macOS. Missing destination bounds checks let attackers trigger an out-of-bounds buffer write during a remote-control session. As the advisory notes, “The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs).”

Second, CVE-2026-111585 (CVSS 8.8) is an integer overflow (CWE-190) in the remote-control screen decompression component. When a user connects to a malicious or compromised remote host, crafted screen data can trigger a heap-based buffer overflow, causing a crash or executing arbitrary code with viewer process privileges.

macOS Local Privilege Escalation

Third, CVE-2026-92374 (CVSS 7.8) stems from a time-of-check time-of-use (TOCTOU) race condition (CWE-367) and improper symbolic link handling in the macOS privileged helper. A low-privileged local attacker can bypass installer package verification, install a malicious package, and gain root privileges.

Affected Versions

These TeamViewer vulnerabilities impact Full Client, Host, Portable, and Android Remote Control App versions prior to 15.83, plus legacy branches V15.64, V14.7, and V13.2. Specifically, CVE-2026-92374 affects macOS, CVE-2026-92372 affects Linux and macOS, and CVE-2026-111585 impacts Windows, Linux, macOS, and Android.

Patch and Mitigation Steps

In its advisory, the vendor states that “TeamViewer strongly recommends that all users update to the latest available version as soon as possible.” Administrators should upgrade main installations to version 15.83, or deploy patched legacy builds 15.64.10, 14.7.48868, 13.2.36231 (Windows), 13.2.154008 (Linux), and 13.2.154007 (macOS).

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.