TeamViewer code smuggling vulnerability narrowly misses critical rating

Security vulnerabilities exist in TeamViewer’s remote maintenance software that attackers could exploit to inject malicious code or escalate their privileges on vulnerable systems. The manufacturer is releasing software updates to address these issues. As the vulnerabilities are classified as high-risk, administrators should not delay in applying the updates.

TeamViewer warns in its security advisory the vulnerabilities in the remote maintenance software. The developers are patching a total of five vulnerabilities, the most severe of which narrowly misses the classification of “critical” risk. These involve insufficient access controls in the host, full client, and derived modules on Linux, macOS, and Windows. Authenticated attackers on the network can exploit them to use functions that are actually impermissible, thereby initiating unauthorized actions and even executing injected code (CVE-2026-92370, CVSS 8.8 , Risk “ high ”).

In addition, the programmers have fixed the following security vulnerabilities in the software:

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients (CVE-2026-19743, CVSS 7.8 , Risk “ high ”)

Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution (CVE-2026-92368, CVSS 7.8 , Risk “ high ”)

Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation (CVE-2026-92369, CVSS 7.3 , Risk “ high ”)

Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording (CVE-2026-92371, CVSS 7.0 , Risk “ high ”)

As the software is affected on all platforms, TeamViewer has also released updated packages for all of them. The developers recommend updating to TeamViewer Full Client (Linux, macOS, Windows) 15.82 and TeamViewer Host (Linux, macOS, Windows) 15.82 or newer. Additionally, the manufacturer provides updates for several older software development branches and links to the downloads in the security advisory. Full client and host from branches 14.7 and 13.2 are available for Linux, macOS, and Windows, while version 15.64 is only for Windows 7 and 8.

At the end of August, TeamViewer last closed security vulnerabilities in its remote maintenance software. These vulnerabilities were also considered high-risk and allowed attackers to inject and execute malicious code from the network.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.