TeamViewer has fixed three high-severity flaws in its remote-access clients that could let an attacker run code on a viewer's machine, crash the viewer application, or gain full control of a Mac. The company published the fixes in security bulletin TV-2026-1011 on 27 October 2026 and urged customers to install version 15.83 or the latest release for their branch. TeamViewer said it was not aware of any active exploitation when the bulletin appeared, so this is a warning about exposure rather than a report of a confirmed breach.

What the three flaws allow

The most serious flaw, CVE-2026-92372, scored 8.8, affects the screen-image decoder in the TeamViewer Full Client for Linux and macOS before version 15.83. Because the decoder does not properly check that incoming image data fits its destination buffer, specially crafted screen data sent during a remote-control session could write beyond that buffer and potentially allow code execution. A second route involves persuading a user to open a malicious session recording file. A second flaw, CVE-2026-111585, also scored 8.8, involves an integer overflow in screen processing that could crash the viewer or, on some platforms, run code with the viewer's privileges when the victim connects to an attacker-controlled or compromised host.

The Mac privilege flaw and what to do

The third flaw, CVE-2026-92374, scored 7.8, affects the privileged helper in the TeamViewer Full Client and Host for macOS. A local attacker with limited permissions could exploit the gap between checking an installer package and using it, bypass package verification, install a malicious package and escalate to root access. Unlike the screen-processing flaws, this one needs existing local access rather than a remote session. Users and IT teams should update every TeamViewer component, connect only to trusted hosts, and treat unexpected session recording files with suspicion.

Sources: TeamViewer security bulletins, Cyber Security News.