SB2026102837 - Multiple vulnerabilities in TeamViewer Client and Host
Published: October 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-92375)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute scripts with SYSTEM or root privileges.
The vulnerability exists due to improper access control in IPC communication between TeamViewer Full Client or Host and the Remote Management Monitoring component when handling inter-process requests. A local user can exploit the insufficient IPC access restrictions to execute scripts with SYSTEM or root privileges.
2) Improper Authentication (CVE-ID: CVE-2026-92376)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code with SYSTEM privileges.
The vulnerability exists due to improper authentication in the IPC mechanism of TeamViewer Remote Management Monitoring for Windows when establishing communication with the IPC broker. A local user can impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with SYSTEM privileges.
3) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-92377)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code with SYSTEM privileges.
The vulnerability exists due to incorrect permission assignment for a critical resource in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows when handling IPC responses and loading executable dependencies. A local user can supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory to execute arbitrary code with SYSTEM privileges.
4) Improper privilege management (CVE-ID: CVE-2026-111582)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to insecure DLL loading in the TeamViewer Remote Management Monitoring installer for Windows when loading libraries during installation. A local user can exploit DLL hijacking, with user interaction required, to execute arbitrary code with elevated privileges.
5) Improper access control (CVE-ID: CVE-2026-111583)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary commands with SYSTEM privileges.
The vulnerability exists due to improper access control in the installer staging directory used by TeamViewer Full Client and Host for Windows when installing Advanced Asset Management during service activation. A local user can place a crafted installer options file that the installer processes, with user interaction required, to execute arbitrary commands with SYSTEM privileges.
6) Race condition (CVE-ID: CVE-2026-111584)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to a race condition in the installation process of TeamViewer Remote Management Patch Management for Windows when activating the service using an insufficiently protected temporary directory. A local user can replace the service executable during activation, with user interaction required, to execute arbitrary code with elevated privileges.
7) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-92374)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to root.
The vulnerability exists due to a time-of-check time-of-use race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host for macOS when verifying and installing packages. A local user can exploit the race condition and symbolic link handling to bypass installer package verification and install a malicious package to escalate privileges to root.
8) Out-of-bounds write (CVE-ID: CVE-2026-92372)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write caused by missing destination bounds checking in the TeamViewer screen-image decoder when processing crafted screen-image data. A remote attacker can supply crafted screen-image data during a remote-control session requiring user interaction, or persuade a user to open a specially crafted TeamViewer session recording (.tvs), to write outside the image buffer and execute arbitrary code.
9) Integer overflow (CVE-ID: CVE-2026-111585)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process.
The vulnerability exists due to an integer overflow leading to a heap-based buffer overflow in the TeamViewer remote-control screen processing component when decompressing screen data. A remote attacker can supply crafted screen data from an attacker-controlled or compromised host after persuading a user to establish a remote-control session to that host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process.
Remediation
Install update from vendor's website.