{"id":"CVE-2026-92372","kind":"vulnerability","aliases":["CVE-2026-92372"],"related":[],"title":"TeamViewer Full Client: screen decoder flaw lets crafted image run code","description":"An out-of-bounds write vulnerability in the\nscreen-image decoder of TeamViewer Full Client for Linux and macOS prior to\nversion 15.83 allows a remote attacker to execute arbitrary code by supplying\ncrafted screen-image data during a remote-control session. The vulnerability\ncan also be exploited by persuading a user to open a specially crafted\nTeamViewer session recording (.tvs). Missing destination bounds checking in the\ndecoder allows crafted screen-image data to cause an out-of-bounds write to the\nimage buffer. Exploitation requires user interaction.","summary":"TeamViewer Full Client for Linux and macOS before 15.83 has an out-of-bounds write in its screen-image decoder. A remote attacker who sends crafted screen data during a session, or a user who opens a crafted .tvs session recording, can execute arbitrary code.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","macos","other","remote-desktop","teamviewer"],"not_affected_if":["no-teamviewer-installed","windows-only"],"how_to_check":"- Run `teamviewer --version` on Linux or check the app version under TeamViewer > About on macOS\n- Check whether any .tvs session recordings from untrusted sources are on the machine","fix":"- Update TeamViewer Full Client for Linux and macOS to `15.83` or later\n- Do not open .tvs session recordings from unknown sources until updated","status":"open","published_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:03+00:00","updated_at":"2026-10-27T16:34:03+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-27T16:34:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update TeamViewer Full Client for Linux and macOS to `15.83` or later\n- Do not open .tvs session recordings from unknown sources until updated","reach":"internet","title":"TeamViewer Full Client: screen decoder flaw lets crafted image run code","impact":"high","summary":"TeamViewer Full Client for Linux and macOS before 15.83 has an out-of-bounds write in its screen-image decoder. A remote attacker who sends crafted screen data during a session, or a user who opens a crafted .tvs session recording, can execute arbitrary code.","category":"other","nicknames":[],"who_cares":["teamviewer","linux","macos","remote-desktop"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the machine via crafted screen data","analyst_note":"Confirm the vendor fixed version and advisory text at the NVD page; sources do not give a TeamViewer advisory link or affected-version floor beyond 15.83.","how_to_check":"- Run `teamviewer --version` on Linux or check the app version under TeamViewer > About on macOS\n- Check whether any .tvs session recordings from untrusted sources are on the machine","needs_analyst":true,"not_affected_if":["windows-only","no-teamviewer-installed"],"who_is_affected":"Machines running TeamViewer Full Client for Linux or macOS before 15.83 are exposed, including those that accept remote-control sessions or open session recordings. Windows installs and machines without TeamViewer can skip it, as the description names only the Linux and macOS clients.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":3416,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92372':14A,17A '15.83':33B,96C 'allow':97C,144C 'also':121C 'arbitrari':70B,103C 'attack':49B,100C 'bound':39B,76C,139C,156C 'buffer':161C 'caus':151C 'check':140C 'client':3A,27B,88C 'code':11A,71B,104C 'control':116C 'craft':8A,52B,64B,107C,132C,145C 'cve':12A,15A 'data':54B,111C,149C 'decod':5A,46B,84C,143C 'desktop':23B 'destin':138C 'execut':69B,102C 'exploit':123C,162C 'flaw':6A 'full':2A,26B,87C 'imag':9A,45B,83C,110C,148C,160C 'interact':165C 'let':7A 'linux':18B,29B,90C 'maco':19B,31B,92C 'miss':137C 'open':62B,129C 'out-of-bound':36B,73C,153C 'persuad':125C 'prior':93C 'record':67B,135C 'remot':22B,48B,99C,115C 'remote-control':114C 'remote-desktop':21B 'requir':163C 'run':10A 'screen':4A,44B,53B,82C,109C,147C 'screen-imag':43B,81C,108C,146C 'send':51B 'session':57B,66B,117C,134C 'special':131C 'suppli':106C 'teamview':1A,24B,25B,86C,133C 'tvs':65B,136C 'user':60B,127C,164C 'version':95C 'vulner':78C,119C 'write':40B,77C,157C","nicknames":[],"mitigations":[],"who_affected":"Machines running TeamViewer Full Client for Linux or macOS before 15.83 are exposed, including those that accept remote-control sessions or open session recordings. Windows installs and machines without TeamViewer can skip it, as the description names only the Linux and macOS clients.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@teamviewer.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92372","severity":null,"published_at":"2026-10-27T16:17:31+00:00","modified_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}