CVE-2026-92368 Overview
CVE-2026-92368 is a heap-based buffer overflow [CWE-122] in TeamViewer Full Client and Host for Linux and macOS prior to version 15.82. The vulnerability resides in the parser that processes .tvs session recording files. A size mismatch during decompression of recorded session data leads to out-of-bounds heap writes. An attacker who convinces a user to open a crafted recording through the "Play or convert recorded session…" feature can achieve arbitrary code execution in the context of the current user.
Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the user who opens the malicious .tvs file, enabling full compromise of the local user account and any data it can access.
Affected Products
- TeamViewer Full Client for Linux prior to version 15.82
- TeamViewer Full Client for macOS prior to version 15.82
- TeamViewer Host for Linux and macOS prior to version 15.82
Discovery Timeline
- 2026-09-29 - CVE-2026-92368 published to the National Vulnerability Database
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-92368
Vulnerability Analysis
The flaw lives in the routine that decompresses recorded session data inside .tvs files. The parser trusts a size value embedded in the recording and uses it to guide decompression into a heap buffer. When the declared size and the actual decompressed data length disagree, the routine writes past the end of the allocated buffer. These out-of-bounds writes corrupt adjacent heap metadata and application objects.
An attacker who controls the recording controls the shape and content of those writes. That primitive is sufficient to hijack control flow within the TeamViewer process. Because the playback feature runs in the user's own session, code executes with that user's privileges rather than elevated ones. On workstations used by administrators, engineers, or IT staff, that user context is still highly valuable to an attacker.
Root Cause
The root cause is missing validation between the declared decompressed size and the actual output length during .tvs recording ingestion. The vulnerable routine allocates a heap buffer based on attacker-influenced metadata and writes decompressed bytes without enforcing the allocated bound. TeamViewer addressed the defect in version 15.82 by correcting the size handling in the recording parser.
Attack Vector
Exploitation requires local user interaction. An attacker delivers a malicious .tvs file through email, chat, shared storage, or a compromised support workflow. The victim opens the file in TeamViewer using the "Play or convert recorded session…" feature. The parser then processes the crafted stream and triggers the heap overflow, resulting in arbitrary code execution. No network exposure of the TeamViewer service is required, and no prior authentication to a TeamViewer account is needed.
No public proof-of-concept has been published. Technical specifics are documented in the TeamViewer Security Bulletin TV-2026-1010.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-92368
Indicators of Compromise
- Unexpected .tvs files arriving through email, messaging platforms, or shared drives, especially from external senders.
- TeamViewer processes (TeamViewer, tv_bin, TeamViewer_Desktop) spawning shells, scripting interpreters, or network utilities shortly after opening a recording.
- Crashes or abnormal terminations of the TeamViewer client on Linux or macOS correlated with .tvs file access.
Detection Strategies
- Alert on process lineage where TeamViewer binaries create child processes such as bash, sh, zsh, python, osascript, or curl.
- Monitor for file writes and executable drops in the user's home directory immediately after .tvs file access.
- Inspect endpoint logs for TeamViewer client version strings below 15.82 on macOS and Linux hosts.
Monitoring Recommendations
- Ingest endpoint telemetry from macOS and Linux fleets and hunt for .tvs file opens outside of expected support workflows.
- Track outbound connections initiated by TeamViewer child processes and compare against known-good baselines.
- Enable crash reporting on macOS and Linux endpoints to surface heap corruption events in the TeamViewer process.
How to Mitigate CVE-2026-92368
Immediate Actions Required
- Upgrade all TeamViewer Full Client and Host installations on Linux and macOS to version 15.82 or later.
- Inventory endpoints running vulnerable versions and prioritize systems used by IT support and administrative staff.
- Instruct users to reject unsolicited .tvs recordings and to verify the source before opening any session recording.
Patch Information
TeamViewer released fixed builds in version 15.82 for Full Client and Host on Linux and macOS. Refer to the TeamViewer Security Bulletin TV-2026-1010 for the exact fixed versions per platform and for download locations.
Workarounds
- Do not open .tvs session recording files from untrusted or unverified sources until patched.
- Restrict the ability to execute the TeamViewer client on endpoints that do not require remote support functionality.
- Use application allowlisting or file association controls to prevent double-click handling of .tvs files on high-value hosts.
# Verify installed TeamViewer version on macOS and Linux
# macOS
defaults read /Applications/TeamViewer.app/Contents/Info.plist CFBundleShortVersionString
# Linux (Debian/Ubuntu)
dpkg -l | grep -i teamviewer
# Linux (RHEL/Fedora)
rpm -qa | grep -i teamviewer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
