TeamViewer Patches Critical Vulnerabilities Enabling Code Execution and Privilege Escalation
TeamViewer has released updates to address three high-severity vulnerabilities, including two that could allow arbitrary code execution and one enabling privilege escalation on macOS.
TeamViewer has issued urgent security updates to address three critical vulnerabilities affecting its remote desktop client software. The flaws, detailed in security bulletin TV-2026-1011, carry CVSS scores as high as 8.8 and could enable attackers to execute malicious code, cause application crashes, or gain elevated privileges on macOS systems. The company recommends updating to version 15.83 or the latest available release to mitigate these risks. At the time of the bulletin's publication, TeamViewer stated it was unaware of any active exploitation.
Two of the vulnerabilities, CVE-2026-92372 and CVE-2026-111585, both rated with a CVSS score of 8.8, pose a risk of arbitrary code execution or application crashes during remote desktop sessions. CVE-2026-92372 affects the screen-image decoder in TeamViewer Full Client for Linux and macOS. It fails to properly validate incoming image data, potentially allowing specially crafted data to overwrite memory beyond its allocated buffer, leading to code execution. Exploitation of this flaw requires user interaction, such as opening a malicious TeamViewer session recording file.
CVE-2026-111585 involves an integer overflow during screen processing, resulting in a heap-based buffer overflow. A compromised or malicious remote host could exploit this to crash the TeamViewer viewer application. Depending on the operating system, this could also lead to code execution with the privileges of the viewer process. Successful exploitation necessitates the victim establishing a remote-control session with the affected host.
The third vulnerability, CVE-2026-92374, rated at CVSS 7.8, specifically targets the privileged helper component in TeamViewer Full Client and Host for macOS. This flaw combines a timing issue with insecure handling of symbolic links. A local attacker with limited privileges could exploit this to bypass package verification and install a malicious package, ultimately escalating their privileges to root.
These vulnerabilities impact a range of TeamViewer products, including TeamViewer Remote, TeamViewer Tensor, and TeamViewer ONE, affecting client components across Windows, Linux, and macOS. The company has provided specific legacy fixes for older versions, such as 15.64.10 for Windows 7 and 8, and 14.7.48868 for other supported legacy platforms, alongside platform-specific 13.2 builds.
Users are strongly advised to update their TeamViewer installations to the latest version to protect against these threats. The potential for attackers to compromise remote sessions, even without full desktop control, highlights the importance of keeping remote access software up-to-date. The disclosure follows previous reports of other TeamViewer vulnerabilities, emphasizing the ongoing need for vigilance in securing remote access solutions.
The implications of these vulnerabilities underscore the critical need for robust security practices when utilizing remote desktop software. Attackers can leverage even seemingly minor flaws to gain a foothold, execute malicious code, or escalate privileges, potentially leading to significant data breaches or system compromise. Staying informed about security advisories and promptly applying patches remains a cornerstone of effective cybersecurity hygiene.