TeamViewer Vulnerabilities Could Let Hackers Execute Malicious Code Through Remote Desktop Sessions

TeamViewer has released security updates for three high-severity vulnerabilities that could let attackers run malicious code, crash remote desktop clients, or gain root access on macOS. The flaws affect client components used with TeamViewer Remote, TeamViewer Tensor, and TeamViewer ONE, with CVSS scores reaching 8.8.

The company published security bulletin TV-2026-1011 on October 27, 2026, and urged customers to install version 15.83 or the latest available release. TeamViewer said it was not aware of active exploitation when it published the bulletin.

CVE-2026-92372, rated 8.8, affects the screen-image decoder in TeamViewer Full Client for Linux and macOS before version 15.83. The decoder processes image data received during remote-control sessions. Still, it fails to check whether incoming data fits within the destination image buffer.

An attacker could supply specially crafted screen-image data that writes beyond the allocated memory space, potentially allowing arbitrary code execution. A second route involves convincing a user to open a malicious TeamViewer session recording with the .tvs extension. Both routes require user interaction.

TeamViewer Remote Desktop Session Flaws

The bulletin also lists Linux and macOS Host installations and older 14.7 and 13.2 branches in the affected-version section. This makes it important to check installed components, not just the main desktop application.

The second remote-session flaw, CVE-2026-111585, also carries an 8.8 score. It involves an integer overflow during screen processing that can lead to a heap-based buffer overflow, where data exceeds its assigned memory area.

A malicious or compromised remote host could use the flaw to crash the viewer application. Depending on the platform, it could also execute code with the viewer process’s privileges.

Exploitation requires the victim to establish a remote-control session with that host. Affected software includes Full Client on Windows, Linux, and macOS, Windows Portable, and the Android Remote Control app before version 15.83.

CVE-2026-92374, rated 7.8, affects the privileged helper in TeamViewer Full Client and Host for macOS. It combines a timing flaw with unsafe handling of symbolic links, which point to other files or locations.

A local attacker with limited permissions could exploit the gap between checking an installer package and using it. Bypassing package verification could allow installation of a malicious package and escalation to root. Unlike the screen-processing flaws, this issue requires existing local access.

These fixes follow earlier reports covering TeamViewer remote-session vulnerabilities and a separate TeamViewer file-transfer vulnerability. Those reports address different flaws and should not be confused with the three newly disclosed issues in this bulletin.

TeamViewer recommends updating through its official download page. Legacy fixes include 15.64.10 for Windows 7 and 8, 14.7.48868 across supported legacy platforms, and platform-specific 13.2 builds.

The key risk is that connecting to a hostile computer can expose the viewer itself. Users do not need to grant an attacker normal control of their desktop for these screen-processing vulnerabilities to become relevant.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post TeamViewer Vulnerabilities Could Let Hackers Execute Malicious Code Through Remote Desktop Sessions appeared first on Cyber Security News.