# TeamViewer Remote Desktop Session Vulnerabilities (CVE-2026-92372, CVE-2026-111585, CVE-2026-92374) Enable Code Execution

> TeamViewer security bulletin TV-2026-1011 (2026-10-27) discloses three vulnerabilities: an out-of-bounds write in the screen-image decoder (CVE-2026-92372, CVSS 8.8), an integer overflow in screen processing (CVE-2026-111585, CVSS 8.8), and a TOCTOU race with unsafe symlink handling in the macOS privileged helper (CVE-2026-92374, CVSS 7.8). TeamViewer was not aware of active exploitation at publication; version 15.83 fixes all three.

- **Published:** 2026-10-28T16:11:35Z
- **Last reviewed:** 2026-10-28T16:11:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4657
- **ID:** TL-2026-4657
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-92372, CVE-2026-111585, CVE-2026-92374

## Description

TeamViewer bulletin TV-2026-1011 (priority: Important), published 2026-10-27, affects TeamViewer Remote, Tensor and ONE client components.

CVE-2026-92372 (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R, CWE-123) is an out-of-bounds write in the screen-image decoder. The decoder lacks destination bounds checking, so a remote attacker supplying crafted screen-image data during a remote-control session, or a malicious .tvs session-recording file, can execute arbitrary code on the victim. It affects Full Client and Host on Linux and macOS prior to 15.83, plus legacy branches 14.7 and 13.2 on Linux and macOS.

CVE-2026-111585 (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R, CWE-190) is an integer overflow in screen processing that leads to a heap-based buffer overflow. A malicious or compromised remote host that a user connects to can cause denial of service or potentially code execution with the privileges of the viewer process. It affects Full Client and Portable on Windows, Linux and macOS and the Android Remote Control app prior to 15.83, plus legacy branches 15.64, 14.7 and 13.2.

CVE-2026-92374 (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N, CWE-367) is a time-of-check/time-of-use race condition combined with improper symbolic link handling in the macOS privileged helper. A local low-privileged attacker can bypass installer package verification and install a malicious package, escalating privileges (reported as root). It affects Full Client and Host on macOS prior to 15.83 and legacy branches 14.7 and 13.2.

Fixes: 15.83 or latest; legacy builds 15.64.10 (Windows 7/8), 14.7.48868 and platform-specific 13.2 builds. TeamViewer stated it was not aware of active exploitation in the wild. No public PoC, threat actor attribution or network IOCs are reported in the sources. Note: the secondary news article describes the CVE-2026-92374 impact as root escalation and CVE-2026-92372 as also reachable via .tvs files; the vendor bulletin and NVD are treated as authoritative. This bulletin follows TV-2026-1010 (2026-09-29, fixed in 15.82), which covered similar session-recording and privilege-escalation issues.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1219 Remote Access Tools

## Sources

- [TeamViewer Security Bulletin TV-2026-1011](https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/)
- [NVD - CVE-2026-92372](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-92372)
- [TeamViewer Vulnerabilities Could Let Hackers Execute Malicious Code Through Remote Desktop Sessions](https://cybersecuritynews.com/teamviewer-desktop-session-vulnerabilities/)
- [TeamViewer Security Bulletin TV-2026-1010 (related, fixed in 15.82)](https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/)
- [TeamViewer Security Bulletins index](https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4657