TeamViewer has identified and addressed multiple high-severity security vulnerabilities that could potentially be exploited to execute malicious code remotely. These vulnerabilities impact various components within TeamViewer Remote, TeamViewer Tensor, and TeamViewer ONE, with some having a CVSS score as high as 8.8.
Details of the Vulnerabilities
On October 27, 2026, TeamViewer released security bulletin TV-2026-1011, strongly advising users to upgrade to version 15.83 or the latest available version. At the time of the bulletin’s release, the company had not observed any active exploitation of these vulnerabilities.
One of the vulnerabilities, identified as CVE-2026-92372, affects the screen-image decoder used in the TeamViewer Full Client for Linux and macOS versions prior to 15.83. The flaw lies in the decoder’s failure to correctly validate incoming data sizes, which can result in arbitrary code execution if an attacker sends specially crafted data. Additionally, opening a malicious .tvs session recording file could trigger the exploit, both scenarios requiring user interaction.
Impacted Platforms and Exploitation Potential
The bulletin also mentions other affected versions, including older Linux and macOS Host installations, as well as branches 14.7 and 13.2. This highlights the necessity of inspecting all installed components beyond the main application.
Another significant vulnerability, CVE-2026-111585, shares a CVSS score of 8.8. It involves an integer overflow during screen processing, leading to a heap-based buffer overflow. This flaw can cause the application to crash or execute unauthorized code with the viewer’s privileges when a remote-control session is established.
This issue affects TeamViewer’s Full Client on Windows, Linux, and macOS, along with Windows Portable and the Android Remote Control app prior to version 15.83.
Local Exploitation Concerns
CVE-2026-92374, rated at 7.8, targets the privileged helper in TeamViewer Full Client and Host for macOS. By exploiting a timing flaw alongside unsafe symbolic link handling, an attacker with local access can bypass package verification to install malicious software, potentially achieving root access.
Unlike the remote vulnerabilities, this particular exploit requires the attacker to already have local access to the system, making it distinct in its exploitation requirements.
These newly disclosed issues follow previous reports on remote-session vulnerabilities and a separate file-transfer vulnerability within TeamViewer. It is crucial not to confuse these new vulnerabilities with past issues.
Recommendations and Future Outlook
TeamViewer urges users to download updates from its official site to mitigate these risks. They have also released legacy updates for older systems, like Windows 7 and 8, and specific platform builds.
The emergence of AI in cybersecurity means that the speed and efficiency of cyberattacks are increasing. It is imperative for users to ensure their defenses are equipped to counter these evolving threats promptly.
