Incorrect permission assignment for critical resource in TeamViewer products - CVE-2026-92377

Vulnerability identifier: #VU158331

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-92377

CWE-ID: CWE-732

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code with SYSTEM privileges.

The vulnerability exists due to incorrect permission assignment for a critical resource in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows when handling IPC responses and loading executable dependencies. A local user can supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory to execute arbitrary code with SYSTEM privileges.

TeamViewer Remote Full Client for Windows
TeamViewer Host for macOS
TeamViewer Full Client for macOS
TeamViewer Host for Linux
TeamViewer Full Client for Linux
TeamViewer Remote Host for Windows

Install security update from vendor's website.

TeamViewer Remote Full Client for Windows - addressed in versions 13.2.36231, 14.7.48868, 15.64.10, 15.83
TeamViewer Remote Host for Windows - addressed in versions 13.2.36231, 14.7.48868, 15.64.10, 15.83
TeamViewer Host for macOS - addressed in versions 13.2.154007, 14.7.259386, 15.83
TeamViewer Full Client for macOS - addressed in versions 13.2.154007, 14.7.259386, 15.83
TeamViewer Host for Linux - addressed in versions 13.2.154008, 14.7.48868, 15.83
TeamViewer Full Client for Linux - addressed in versions 13.2.154008, 14.7.48868, 15.83

• https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/

• Multiple vulnerabilities in TeamViewer Client and Host