Live › vulnerability › CVE-2026-92374
Go to dashboardA race condition plus unsafe symbolic link handling in the privileged helper of TeamViewer Full Client and Host for macOS lets a local user bypass installer package checks. An attacker who wins the race installs a malicious package and gains root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Macs running TeamViewer Full Client or Host older than are exposed, and any local user account on such a machine can use it. Machines without TeamViewer installed, or on or later, can skip it. The sources do not describe a managed-hosting or remote-only path.
15.8315.83No product ranges from the sources yet.
defaults read /Applications/TeamViewer.app/Contents/Info CFBundleShortVersionStringls -l /Library/PrivilegedHelperTools/ and note any TeamViewer helper files15.83 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.
This page as .md · .json · in your agent: get_signal("CVE-2026-92374")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.