{"id":"CVE-2026-92374","kind":"vulnerability","aliases":["CVE-2026-92374"],"related":[],"title":"TeamViewer macOS helper race lets local users install root-level packages","description":"A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.","summary":"A race condition plus unsafe symbolic link handling in the privileged helper of TeamViewer Full Client and Host for macOS lets a local user bypass installer package checks. An attacker who wins the race installs a malicious package and gains root.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","macos","runtime","teamviewer"],"not_affected_if":["teamviewer-not-installed","version-15.83-or-later"],"how_to_check":"- Check the installed TeamViewer version in the About dialog or with `defaults read /Applications/TeamViewer.app/Contents/Info CFBundleShortVersionString`\n- List the privileged helper with `ls -l /Library/PrivilegedHelperTools/` and note any TeamViewer helper files","fix":"- Update TeamViewer Full Client and Host on macOS to `15.83` or later","status":"open","published_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:12+00:00","updated_at":"2026-10-27T16:34:12+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-27T16:34:12Z","model":"claude-haiku-5-5","output":{"fix":"- Update TeamViewer Full Client and Host on macOS to `15.83` or later","reach":"local","title":"TeamViewer macOS helper race lets local users install root-level packages","impact":"high","summary":"A race condition plus unsafe symbolic link handling in the privileged helper of TeamViewer Full Client and Host for macOS lets a local user bypass installer package checks. An attacker who wins the race installs a malicious package and gains root.","category":"runtime","nicknames":[],"who_cares":["macos","teamviewer","endpoints"],"confidence":0.8,"needs_auth":"yes","worst_case":"local user gains root on the Mac","analyst_note":"Confirm the affected version range and whether the fix in 15.83 is the only remediation; check the NVD entry and TeamViewer's security bulletin for details.","how_to_check":"- Check the installed TeamViewer version in the About dialog or with `defaults read /Applications/TeamViewer.app/Contents/Info CFBundleShortVersionString`\n- List the privileged helper with `ls -l /Library/PrivilegedHelperTools/` and note any TeamViewer helper files","needs_analyst":true,"not_affected_if":["teamviewer-not-installed","version-15.83-or-later"],"who_is_affected":"Macs running TeamViewer Full Client or Host older than `15.83` are exposed, and any local user account on such a machine can use it. Machines without TeamViewer installed, or on `15.83` or later, can skip it. The sources do not describe a managed-hosting or remote-only path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3337,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-92374':15A,18A '15.83':95C 'allow':98C 'attack':52B,101C 'bypass':47B,106C 'check':50B,68C 'client':38B,89C 'combin':76C 'condit':25B,75C 'cve':13A,16A 'endpoint':19B 'escal':122C 'exploit':116C 'full':37B,88C 'gain':62B 'handl':30B,81C 'helper':3A,34B,85C 'host':40B,91C 'improp':78C 'instal':8A,48B,57B,107C,111C 'lead':118C 'let':5A,43B 'level':11A 'link':29B,80C 'local':6A,45B,100C,120C 'low':103C 'maco':2A,20B,42B,97C 'malici':59B,113C 'packag':12A,49B,60B,108C,114C 'plus':26B 'prior':92C 'privileg':33B,84C,104C,121C 'race':4A,24B,56B,74C 'root':10A,63B,124C 'root-level':9A 'runtim':21B 'success':115C 'symbol':28B,79C 'teamview':1A,22B,36B,87C 'time':66C,70C 'time-of-check':65C 'time-of-us':69C 'toctou':73C 'unsaf':27B 'use':72C 'user':7A,46B 'verif':109C 'version':94C 'win':54B","nicknames":[],"mitigations":[],"who_affected":"Macs running TeamViewer Full Client or Host older than `15.83` are exposed, and any local user account on such a machine can use it. Machines without TeamViewer installed, or on `15.83` or later, can skip it. The sources do not describe a managed-hosting or remote-only path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@teamviewer.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92374","severity":null,"published_at":"2026-10-27T16:17:31+00:00","modified_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}