Read the docs
TI-2026-81359 Aliases CVE-2026-92372GHSA-2p63-5vwr-rhf8

Out-of-bounds write in TeamViewer Full Client for Linux and macOS

Priority MEDIUM 40CWE-123Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

TeamViewer Full Client for Linux and macOS before version 15.83 is affected. A missing destination bounds check in the screen-image decoder (CWE-123) lets crafted screen-image data write past the image buffer. A remote attacker can execute arbitrary code by sending crafted screen-image data during a remote-control session, and user interaction is required, such as opening a crafted TeamViewer session recording (.tvs).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Fixed Full Client (TeamViewer): 15.83, 14.7.48868 (Linux), 14.7.48868 (macOS) +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TeamViewerFull Clientbefore 15.83; 14.7.0 (Linux) to before 14.7.48868 (Linux); 14.7.0 (macOS) to before 14.7.48868 (macOS); 13.2.0 (Linux) to before 13.2.154008 (Linux); 13.2.0 (macOS) to before 13.2.154007 (macOS)15.83, 14.7.48868 (Linux), 14.7.48868 (macOS), 13.2.154008 (Linux), 13.2.154007 (macOS)Patch availableCNA
  • Full Client VendorTeamViewer Affected before 15.83; 14.7.0 (Linux) to before 14.7.48868 (Linux); 14.7.0 (macOS) to before 14.7.48868 (macOS); 13.2.0 (Linux) to before 13.2.154008 (Linux); 13.2.0 (macOS) to before 13.2.154007 (macOS) Fixed in 15.83, 14.7.48868 (Linux), 14.7.48868 (macOS), 13.2.154008 (Linux), 13.2.154007 (macOS) Patch available CNA

Remediation

Upgrade TeamViewer Full Client to version 15.83 or later. Fixed versions for Linux are 14.7.48868 and 13.2.154008, and fixed versions for macOS are 14.7.48868 and 13.2.154007.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Full Client (TeamViewer) Fixed in 15.83, 14.7.48868 (Linux), 14.7.48868 (macOS), 13.2.154008 (Linux), 13.2.154007 (macOS)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TeamViewer Full Client — teamviewer.com/en/resources/trust-center/security-bulletins…

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-81368 Integer overflow in TeamViewer screen processing enables heap overflowPriority MEDIUM 40
    • TI-2026-81360 Privilege escalation via insecure package handling in TeamViewer for macOSPriority LOW 35
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-92372
  2. 2026-10-27 Alias added: GHSA-2p63-5vwr-rhf8
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed
  5. 2026-11-04 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2019-13681 TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control… KEVCVSS 3.1HIGH 7.0
  • TI-2020-10745 TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI… CVSS 3.1HIGH 8.8
  • TI-2010-02989 Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local… CVSS 2.0HIGH 9.3
  • TI-2021-13849 Memory corruption in TeamViewer CVSS 3.1HIGH 8.8
  • TI-2018-11870 TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force… CVSS 3.0CRITICAL 9.8
  • TI-2025-28565 File Hash Validation Bypass in NomadBranch.exe CVSS 3.1HIGH 8.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences