Out-of-Bounds Write Vulnerability in TeamViewer Full Client for Linux and macOS
CVE-2026-92372

8.8HIGH

Key Information:

Vendor

Teamviewer

Status
Full Client
Vendor
CVE Published:
27 October 2026

What is CVE-2026-92372?

An out-of-bounds write vulnerability exists in the screen-image decoder of TeamViewer Full Client for Linux and macOS before version 15.83. This flaw allows a remote attacker to execute arbitrary code by sending specially crafted screen-image data during a remote control session. Additionally, the vulnerability can be exploited if a user opens a malicious TeamViewer session recording (.tvs). The missing destination bounds checking in the decoder enables crafted data to cause an out-of-bounds write, necessitating user interaction for exploitation.

Affected Version(s)

Full Client MacOS 0 < 15.83

Full Client MacOS 14.7.0 (Linux) < 14.7.48868 (Linux)

Full Client MacOS 14.7.0 (macOS) < 14.7.48868 (macOS)

References

https://www.teamviewer.com/en/resources/trust-center/secu...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)
.