Race Condition Vulnerability in TeamViewer Full Client and Host for macOS
CVE-2026-92374

7.8HIGH

Key Information:

Vendor

Teamviewer

Status
Full Client
Host
Vendor
CVE Published:
27 October 2026

What is CVE-2026-92374?

A time-of-check time-of-use (TOCTOU) race condition exists in the privileged helper of TeamViewer Full Client and Host for macOS. This vulnerability arises due to improper handling of symbolic links, allowing a local attacker with limited privileges to circumvent installer package verification. The exploitation of this flaw could result in an attacker successfully installing a malicious package, ultimately escalating their privileges to root level on the affected system. Users are advised to update to the latest version to mitigate this risk.

Affected Version(s)

Full Client MacOS 0 < 15.83

Full Client MacOS 14.7.0 < 14.7.48868

Full Client MacOS 13.2.0 < 13.2.154007

References

https://www.teamviewer.com/en/resources/trust-center/secu...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)
.