CVE-2026-92372: Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution
An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TeamViewer Full Client for Linux and macOSto a version that resolves this vulnerability.Fixed in 15.83
Event History
Frequently Asked Questions
Which deployments are affected?
TeamViewer Full Client installations on Linux and macOS prior to version 15.83 are affected. The provided information does not identify other TeamViewer clients or platforms as affected.
What does an attacker need to exploit this vulnerability?
An attacker needs to provide crafted screen-image data during a remote-control session, or persuade a user to open a specially crafted TeamViewer session recording with a .tvs extension. User interaction is required.
What is the practical impact of successful exploitation?
Successful exploitation can allow a remote attacker to execute arbitrary code on the system running the affected TeamViewer Full Client.
How can I determine whether remediation is needed?
Identify TeamViewer Full Client installations on Linux and macOS and check their version. Versions earlier than 15.83 require remediation.