Advisory · CVE-2026-92372
Out-of-bounds write in TeamViewer screen decoder can execute code during a session
TeamViewer Full Client for Linux and macOS before 15.83 contains an out-of-bounds write in the screen-image decoder that lets a remote attacker execute arbitrary code by supplying crafted screen-image data during a remote-control session, or by persuading a user to open a crafted session recording. CVSS 3.1 8.8.
- Vendor
- TeamViewer
- Product
- TeamViewer
- Identifier / CWE
- CVE-2026-92372
CWE-123 - Action timing
- Immediate
Explain it like I’m five
The client paints the remote screen from data the other side sends, without checking the picture fits the canvas. A malicious host can send an oversized picture that writes over the client's memory and turns into code.
- 01Session or recording started
The victim connects to an attacker-controlled host, or opens a crafted TeamViewer session recording (.tvs).
- 02Crafted image data sent
The host supplies screen-image data designed to exceed the decoder's destination bounds.
- 03Out-of-bounds write lands
Missing destination bounds checking lets the decoder write outside the image buffer.
- 04Code executes
The corruption lets the attacker execute arbitrary code in the client process.
What happened
TeamViewer published CVE-2026-92372 on October 27, 2026 in bulletin TV-2026-1011, rated high at CVSS 3.1 8.8: an out-of-bounds write vulnerability (CWE-123) in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. TeamViewer states the flaw can also be exploited by persuading a user to open a specially crafted session recording, and that exploitation requires user interaction.
The record lists Full Client versions before 15.83 as affected on Linux and macOS, along with the legacy 14.7 and 13.2 branches up to their respective fixed builds in the bulletin.
What to do
- Inventory TeamViewer Full Client, Host, Portable, and Remote Control app installations and note versions per platform.
- Update clients to 15.83 or later (and legacy branches to the fixed builds in bulletin TV-2026-1011).
- Until updated, advise users to end sessions with unknown hosts and not to open TeamViewer session recordings from untrusted sources.
- Review endpoint telemetry for TeamViewer processes crashing or spawning unexpected processes during or after sessions.
- Verify the running client version after updating, including unattended Host installations.
Management note
Remote access tools are high-value targets because they are trusted by design and present on every endpoint. Keep TeamViewer on the same rapid ring as browsers, and make sure unattended hosts, the easiest installs to forget, are in the count.