TeamViewer patches three flaws enabling code execution and escalation

TeamViewer has issued security bulletin TV-2026-1011, published on 27 October 2026, noting three high-severity vulnerabilities in the TeamViewer Full Client across Windows, macOS, Linux and Android. The flaws enable remote code execution or local privilege escalation through memory corruption in screen processing and insecure package handling.

CVE-2026-92372 is an out-of-bounds write in the Linux/macOS screen-image decoder, which can be exploited via a remote-control session or by coaxing a user to open a crafted .tvs recording. CVE-2026-111585 is an integer overflow in the remote-control screen decompression component that can trigger a heap-based buffer overflow during a session. CVE-2026-92374 is a macOS-specific TOCTOU race condition in the privileged helper, enabling a low-privileged user to bypass installer verification and gain root privileges.

TeamViewer states that none of the three CVEs have been exploited in the wild at the time of publication, and no public PoC exploits have been confirmed. The vendor lists affected products as TeamViewer Full Client, Host, Portable, and Android Remote Control App, with versions prior to 15.83 and legacy branches (V15.64, V14.7, V13.2) affected to varying extents by the three CVEs.

Patches are available: upgrade to 15.83, with legacy builds 15.64.10, 14.7.48868, 13.2.154008 (Windows), 13.2.154007 (macOS) and 13.2.36231 (Windows) as applicable mitigations. Administrators are advised to update as soon as possible.