TeamViewer has fixed nine security vulnerabilities across its remote access clients and management add-ons, including flaws that can enable remote code execution and allow low-privileged users to gain SYSTEM or root access.
TeamViewer has released security updates for nine high-severity vulnerabilities affecting its remote access software and Remote Management components, including flaws that can allow code execution during remote-control sessions and local attacks that elevate privileges to SYSTEM or root.
The vulnerabilities are detailed in two security advisories. TV-2026-1011 covers three flaws affecting TeamViewer Remote, Tensor and ONE clients, while TV-2026-1012 addresses six privilege-escalation vulnerabilities in Monitoring, Patch Management and Advanced Asset Management components.
TeamViewer said it was not aware of any active exploitation of the vulnerabilities when the advisories were published.
Malicious remote computers can attack TeamViewer viewers
Two of the client vulnerabilities carry CVSS scores of 8.8 and can potentially lead to arbitrary code execution.
CVE-2026-111585 is particularly notable because it reverses the normal remote-support threat model. Instead of attacking the computer being controlled, a malicious or already compromised remote computer can target the TeamViewer user who connects to it.
TeamViewer’s client security advisory says the vulnerability is caused by an integer overflow in the software’s remote-control screen processing. An attacker-controlled host can supply specially crafted screen information after the victim establishes a remote-control session, potentially triggering a heap-based buffer overflow.
Successful exploitation can cause a denial of service or, depending on the affected platform and exploitation method, allow arbitrary code to run with the privileges of the TeamViewer viewer process. User interaction is required because the victim must first establish a session with the malicious or compromised host.
Security researcher Omri Dar of Remedio, who reported the flaw, published a technical analysis of CVE-2026-111585 describing how attacker-controlled screen dimensions can cause a buffer-size calculation to overflow.
Remedio demonstrated code execution on Windows and said its exploit bypassed protections including Data Execution Prevention and Control Flow Guard. The researchers also noted that part of the demonstration relied on a host-side hook to supply attack data, meaning the published proof of concept was not a fully network-only end-to-end exploit.
The flaw affects TeamViewer Full Client and Portable releases before version 15.83 on Windows, Linux and macOS, as well as the TeamViewer Remote Control application on Android before version 15.83.
Another 8.8-rated vulnerability, CVE-2026-92372, affects the screen-image decoder in TeamViewer clients for Linux and macOS. A remote attacker can supply crafted screen-image data during a remote-control session to trigger an out-of-bounds write and potentially execute arbitrary code. The flaw can also be triggered if a user opens a malicious TeamViewer session recording.
The third client vulnerability, CVE-2026-92374, affects TeamViewer on macOS. A race condition and improper handling of symbolic links can allow a low-privileged local attacker to bypass package verification and install a malicious package with root privileges.
Six Remote Management flaws can provide SYSTEM or root access
A separate TeamViewer advisory details six vulnerabilities affecting the company’s Remote Management add-ons. The flaws involve weaknesses in inter-process communication, DLL loading, installation processes and temporary-file handling.
Three of the vulnerabilities carry CVSS scores of 7.8.
CVE-2026-92375 affects communication between TeamViewer clients and the Monitoring component. A low-privileged local user can exploit inadequate access controls to execute scripts as SYSTEM on Windows or root on Linux and macOS.
CVE-2026-92376 affects the Monitoring component on Windows and allows a low-privileged attacker to impersonate its inter-process communication broker, potentially causing the monitoring service to execute attacker-controlled code with SYSTEM privileges.
CVE-2026-92377 affects the Patch Management update mechanism on Windows. An attacker can abuse the communication process to introduce a signed executable that loads a malicious DLL from a writable temporary directory, resulting in SYSTEM-level code execution.
Three additional vulnerabilities, CVE-2026-111582, CVE-2026-111583 and CVE-2026-111584, involve DLL hijacking, an insufficiently protected installer staging directory and a race condition during Patch Management activation. They can allow a low-privileged local attacker to execute code or commands with elevated permissions under specific conditions. Some require user interaction.
TeamViewer has fixed the current Full Client and Host releases in version 15.83. Version 15.83 is also available for the Windows Portable client and Android Remote Control application where applicable, while TeamViewer has released separate maintenance builds for supported older branches.
For Remote Management, TeamViewer said the affected Monitoring components have been updated to version 26.10.1, while the affected Patch Management service has been updated to version 26.9.1. The company said those Remote Management components are delivered through automatic updates.
TeamViewer recommends updating clients to version 15.83 or the latest available release and ensuring Remote Management services are current.
Leave a Reply