Threat reportVulnerabilityTL-2026-4657
TeamViewer Remote Desktop Session Vulnerabilities (CVE-2026-92372, CVE-2026-111585, CVE-2026-92374) Enable Code Execution
TeamViewer Remote Desktop Session Vulnerabilities (TL-2026-4657), also tracked as TV-2026-1011, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-28. It has no confirmed attribution, affects TeamViewer TeamViewer Full Client and Host (Linux, macOS) -, references 3 CVEs (CVE-2026-92372, CVE-2026-111585, CVE-2026-92374), maps to 3 MITRE ATT&CK techniques (T1203, T1204.002, T1219), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4657
- Threat ID
- TL-2026-4657
- Also known as
- TV-2026-1011
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, managed-service-providers, it-support
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in TeamViewer Remote Desktop Session Vulnerabilities
Malware and tooling: TeamViewer, TeamViewer
How TeamViewer Remote Desktop Session Vulnerabilities works
TeamViewer security bulletin TV-2026-1011 (2026-10-27) discloses three vulnerabilities: an out-of-bounds write in the screen-image decoder (CVE-2026-92372, CVSS 8.8), an integer overflow in screen processing (CVE-2026-111585, CVSS 8.8), and a TOCTOU race with unsafe symlink handling in the macOS privileged helper (CVE-2026-92374, CVSS 7.8). TeamViewer was not aware of active exploitation at publication; version 15.83 fixes all three.
TeamViewer bulletin TV-2026-1011 (priority: Important), published 2026-10-27, affects TeamViewer Remote, Tensor and ONE client components.
CVE-2026-92372 (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R, CWE-123) is an out-of-bounds write in the screen-image decoder. The decoder lacks destination bounds checking, so a remote attacker supplying crafted screen-image data during a remote-control session, or a malicious .tvs session-recording file, can execute arbitrary code on the victim. It affects Full Client and Host on Linux and macOS prior to 15.83, plus legacy branches 14.7 and 13.2 on Linux and macOS.
CVE-2026-111585 (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R, CWE-190) is an integer overflow in screen processing that leads to a heap-based buffer overflow. A malicious or compromised remote host that a user connects to can cause denial of service or potentially code execution with the privileges of the viewer process. It affects Full Client and Portable on Windows, Linux and macOS and the Android Remote Control app prior to 15.83, plus legacy branches 15.64, 14.7 and 13.2.
CVE-2026-92374 (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N, CWE-367) is a time-of-check/time-of-use race condition combined with improper symbolic link handling in the macOS privileged helper. A local low-privileged attacker can bypass installer package verification and install a malicious package, escalating privileges (reported as root). It affects Full Client and Host on macOS prior to 15.83 and legacy branches 14.7 and 13.2.
Fixes: 15.83 or latest; legacy builds 15.64.10 (Windows 7/8), 14.7.48868 and platform-specific 13.2 builds. TeamViewer stated it was not aware of active exploitation in the wild. No public PoC, threat actor attribution or network IOCs are reported in the sources. Note: the secondary news article describes the CVE-2026-92374 impact as root escalation and CVE-2026-92372 as also reachable via .tvs files; the vendor bulletin and NVD are treated as authoritative. This bulletin follows TV-2026-1010 (2026-09-29, fixed in 15.82), which covered similar session-recording and privilege-escalation issues.
MITRE ATT&CK techniques used in TL-2026-4657
Execution
T1203 Exploitation for Client Execution; T1204.002 Malicious File
Command and Control
Affected products and versions in TeamViewer Remote Desktop Session Vulnerabilities
- TeamViewer — TeamViewer Full Client and Host (Linux, macOS) - CVE-2026-92372
Vulnerable versions: prior to 15.83; 14.7; 13.2
Fixed in: 15.83; 14.7.48868; platform-specific 13.2 builds - TeamViewer — TeamViewer Full Client and Portable (Windows, Linux, macOS) and Android Remote Control app - CVE-2026-111585
Vulnerable versions: prior to 15.83; 15.64; 14.7; 13.2
Fixed in: 15.83; 15.64.10 (Windows 7/8); 14.7.48868; platform-specific 13.2 builds - TeamViewer — TeamViewer Full Client and Host (macOS) - CVE-2026-92374
Vulnerable versions: prior to 15.83; 14.7; 13.2
Fixed in: 15.83; 14.7.48868; platform-specific 13.2 builds - TeamViewer — TeamViewer Remote, Tensor, ONE
Vulnerable versions: clients prior to 15.83
Fixed in: 15.83 or latest
Remediation for TeamViewer Remote Desktop Session Vulnerabilities
Patches
- TeamViewer 15.83 or latest
- Legacy: 15.64.10 (Windows 7/8), 14.7.48868, platform-specific 13.2 builds
Immediate actions
- Update TeamViewer Full Client, Host, Portable and the Android Remote Control app to 15.83 or the latest available version
- Avoid opening untrusted .tvs session-recording files in affected clients until patched
- Only start remote-control sessions with trusted, verified hosts until patched
Workarounds
- No vendor workaround stated; patching is the recommended action
Longer-term hardening
- Inventory all TeamViewer installations (Remote, Tensor, ONE) and enforce version compliance
- Restrict remote-access tool use to approved endpoints and monitor for unexpected TeamViewer processes and child processes
- Limit local low-privilege user ability to write to installer or package locations on macOS
CVEs associated with TeamViewer Remote Desktop Session Vulnerabilities
Weaknesses (CWE) in TeamViewer Remote Desktop Session Vulnerabilities
Timeline of TeamViewer Remote Desktop Session Vulnerabilities
- TeamViewer publishes related bulletin TV-2026-1010 (five CVEs, fixed in version 15.82)
- TeamViewer states it is not aware of any active exploitation in the wild at publication
- NVD publishes CVE-2026-92372 (CVSS 3.1 8.8, CWE-123) referencing the TeamViewer bulletin
- Fixed in TeamViewer 15.83, with legacy fixes 15.64.10 (Windows 7/8), 14.7.48868 and platform-specific 13.2 builds
- TeamViewer publishes bulletin TV-2026-1011 (priority Important) disclosing CVE-2026-92372, CVE-2026-111585 and CVE-2026-92374
- Cyber Security News reports on the vulnerabilities enabling code execution through remote desktop sessions
Sources cited for TeamViewer Remote Desktop Session Vulnerabilities
Detection coverage for TL-2026-4657
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4657 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.