Read the docs
TI-2026-81360 Aliases CVE-2026-92374GHSA-mx87-284w-9374

Privilege escalation via insecure package handling in TeamViewer for macOS

Priority LOW 35CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

TeamViewer Full Client and Host for macOS prior to version 15.83 are affected, as are versions from 14.7.0 before 14.7.48868 and from 13.2.0 before 13.2.154007. A time-of-check time-of-use race condition (CWE-367) combined with improper symbolic link handling in the privileged helper lets a local attacker with low privileges bypass installer package verification and install a malicious package. Successful exploitation leads to local privilege escalation to root.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00092 0th percentileScored 2026-11-07
Fix Fixed Full Client (TeamViewer): 15.83, 14.7.48868, 13.2.154007Host (TeamViewer): 15.83, 14.7.48868, 13.2.154007

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TeamViewerFull Clientbefore 15.83; 14.7.0 to before 14.7.48868; 13.2.0 to before 13.2.15400715.83, 14.7.48868, 13.2.154007Patch availableCNA
TeamViewerHostbefore 15.83; 14.7.0 to before 14.7.48868; 13.2.0 to before 13.2.15400715.83, 14.7.48868, 13.2.154007Patch availableCNA
  • Full Client VendorTeamViewer Affected before 15.83; 14.7.0 to before 14.7.48868; 13.2.0 to before 13.2.154007 Fixed in 15.83, 14.7.48868, 13.2.154007 Patch available CNA
  • Host VendorTeamViewer Affected before 15.83; 14.7.0 to before 14.7.48868; 13.2.0 to before 13.2.154007 Fixed in 15.83, 14.7.48868, 13.2.154007 Patch available CNA

Remediation

Update TeamViewer Full Client and TeamViewer Host to version 15.83, 14.7.48868, or 13.2.154007, matching the installed branch. CISA has not listed this vulnerability in its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Full Client (TeamViewer) Fixed in 15.83, 14.7.48868, 13.2.154007
  • Fix · CNA Host (TeamViewer) Fixed in 15.83, 14.7.48868, 13.2.154007

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TeamViewer Full Client — teamviewer.com/en/resources/trust-center/security-bulletins…

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-81368 Integer overflow in TeamViewer screen processing enables heap overflowPriority MEDIUM 40
    • TI-2026-81359 Out-of-bounds write in TeamViewer Full Client for Linux and macOSPriority MEDIUM 40
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-92374
  2. 2026-10-27 Alias added: GHSA-mx87-284w-9374
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Advisory 1

  • TI-2019-13681 TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control… KEVCVSS 3.1HIGH 7.0
  • TI-2020-10745 TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI… CVSS 3.1HIGH 8.8
  • TI-2010-02989 Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local… CVSS 2.0HIGH 9.3
  • TI-2021-13849 Memory corruption in TeamViewer CVSS 3.1HIGH 8.8
  • TI-2018-11870 TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force… CVSS 3.0CRITICAL 9.8
  • TI-2025-28565 File Hash Validation Bypass in NomadBranch.exe CVSS 3.1HIGH 8.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences