TeamViewer has rolled out fixes for three serious security holes that could let attackers run malicious code, crash clients, or gain root access on macOS. These vulnerabilities are present in key client components across TeamViewer Remote, Tensor, and ONE, and have been rated up to 8.8 on the CVSS scale. The update, version 15.83, is strongly recommended to all users. Vulnerabilities of this severity can introduce major risk for remote work environments or shared systems.
Details of the Three High-Severity Vulnerabilities
The first issue, tracked as CVE-2026-92372 with a score of 8.8, exists in the screen-image decoder used by TeamViewer’s Full Client for Linux and macOS (pre-version 15.83). The decoder doesn’t verify whether incoming image data fits within the expected bounds of the image buffer. This can lead to buffer overflows through either a remote-control session or by tricking users into loading malicious session recordings (.tvs files). Either path requires some level of user interaction.
The second flaw, CVE-2026-111585 (also 8.8 severity), affects Full Client across Windows, Linux, and macOS, as well as the Android Remote Control app and Windows Portable variants. An integer overflow in the screen rendering process can trigger a heap-based buffer overflow. Attackers controlling a host could crash the viewer or potentially execute code with the privileges of the viewer process, depending on the platform. As with the first flaw, this requires the user to initiate a remote-control session with a compromised or attacker host.
The third vulnerability, CVE-2026-92374 (rated 7.8), lies in the privileged helper component of TeamViewer Full Client and Host on macOS. It combines a timing issue with unsafe symbolic link handling—allowing local users with limited rights to bypass security checks on installer packages. This could lead to root-level execution. Unlike the screen-processing bugs, this one requires local access.
Who’s Affected & What To Do
The vulnerabilities impact multiple platforms: Linux, macOS, Windows, Android, and legacy branches including versions 14.7 and 13.2. Full Client users on older operating systems are particularly vulnerable. TeamViewer recommends moving to version 15.83 or the latest available for your platform. For systems that can’t update, specific patch builds—such as Windows fixes for older OS versions—are provided.
Though these flaws are serious, there’s no indication TeamViewer is aware of any being exploited in the wild. The advisory was published on October 27, 2026. Users are urged to verify their installed TeamViewer components—not just the main desktop app—and apply updates promptly. For the macOS privileged helper issue, ensuring no untrusted local accounts exist is a precaution until patching can occur.
The most dangerous scenarios come not from remote control commands, but from simply being connected to a malicious host or opening a crafted session file. Users granting full remote control or file access may increase their risk profile significantly.
Below is a breakdown of the vulnerabilities:
- CVE-2026-92372: Buffer overflow via missing bounds check in screen-image decoder (Linux/macOS).
- CVE-2026-111585: Heap overflow via integer overflow in screen processing (multiple platforms).
- CVE-2026-92374: Privilege escalation on macOS via timing and symbolic link misuse, requiring local access.
Why It Matters & What To Watch
TeamViewer is deeply embedded in remote work, IT support, and enterprise environments. High-severity vulnerabilities in its remote session components threaten both individual users and entire organizations—particularly in mixed-OS setups. Buffer overflows and local privilege escalations are classic pathways for malware and attackers. As remote workflows expand, securing such tools isn’t optional.
This isn’t the first time TeamViewer has faced serious security flaws—past reports have highlighted remote-session and file-transfer vulnerabilities. But the scope and severity of these newly disclosed issues are alarming. Administrators should audit all TeamViewer installations on every device and patch immediately.
For users and enterprises alike, the takeaway is clear: update, review access permissions, and limit exposure until patched. These steps reduce risk now, while underscoring the importance of continuous monitoring of remote-access tools.
