Loading vulnerability…
Remote code execution in TeamViewer screen-image decoder
CVE-2026-92372 is an out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS before version 15.83. Missing destination bounds checking allows specially crafted screen-image data to write outside the destination image buffer, potentially enabling arbitrary code execution. Attackers can deliver the data during a remote-control session or through a specially crafted TeamViewer session recording opened by a user. Both exploitation paths require user interaction. Affected installations also include TeamViewer Host on Linux and macOS and vulnerable releases in the 14.7 and 13.2 legacy branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can execute arbitrary code in the context of the affected TeamViewer process, compromising the confidentiality, integrity, and availability of resources accessible to that process. The vulnerability is rated High, with a CVSS v3.1 score of 8.8. Elevated privileges are not an established outcome of this vulnerability alone.
If you can’t patch tonight, do this now.
Until updates are installed, avoid remote-control sessions with untrusted or potentially compromised computers and do not open untrusted TeamViewer session recordings. No vendor-specified workaround is identified; these precautions reduce exposure but do not correct the decoder flaw.
Patch, then assume compromise.
Update affected TeamViewer Full Client and Host installations on Linux and macOS to version 15.83 or a later supported release. For installations remaining on legacy branches, apply version 14.7.48868, or the platform-specific 13.2 fixes: 13.2.154008 for Linux and 13.2.154007 for macOS. Inventory both Full Client and Host installations to ensure all affected components are updated.
No public exploits tracked yet. Mallory keeps watching.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.