CVE-2026-92371: TeamViewer Linux Race Condition Vulnerability

CVE-2026-92371 Overview

CVE-2026-92371 is an improper path validation vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.82. The flaw resides in the Cloud Session Recording (CSR) functionality. A local authenticated attacker can exploit a race condition between path validation and file access to trigger privileged file operations in unintended locations. The weakness is classified under [CWE-59] (Improper Link Resolution Before File Access, or "Link Following").

Critical Impact
A local low-privileged user can coerce TeamViewer into performing privileged file writes outside the intended directory, enabling privilege escalation on affected Linux hosts.

Affected Products

TeamViewer Full Client for Linux prior to version 15.82
TeamViewer Host for Linux prior to version 15.82
Installations with Cloud Session Recording (CSR) functionality enabled

Discovery Timeline

2026-09-29 - CVE-2026-92371 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-92371

Vulnerability Analysis

The vulnerability exists in the Cloud Session Recording feature of TeamViewer for Linux. When CSR writes recording artifacts to disk, it first validates the target path and then opens or creates the file in a separate step. The gap between these two operations creates a Time-of-Check to Time-of-Use (TOCTOU) window. A local authenticated attacker can swap the validated path for a symbolic link pointing to a sensitive system location. TeamViewer then performs the file operation with its own elevated privileges against the attacker-controlled target.

Successful exploitation can lead to arbitrary file creation, overwrite, or truncation in root-owned directories. This enables privilege escalation, tampering with system binaries, or denial of service on the affected host.

Root Cause

The root cause is non-atomic path handling in the CSR component. Path validation and file access are performed as separate syscalls without protection against filesystem state changes between the two. The design does not use O_NOFOLLOW, file descriptor-relative operations, or equivalent safeguards to prevent symlink substitution during the race window.

Attack Vector

Exploitation requires local authenticated access to a Linux host running an affected TeamViewer version with CSR active. The attacker races the TeamViewer process by rapidly replacing a legitimate file or directory in the CSR output path with a symbolic link. When the race succeeds, TeamViewer follows the link and performs the write operation on the attacker-chosen target. The attack has high complexity because it depends on winning a narrow timing window.

No verified public exploit code is available. See the TeamViewer Security Bulletin TV-2026-1010 for vendor technical details.

Detection Methods for CVE-2026-92371

Indicators of Compromise

Unexpected symbolic links appearing inside or adjacent to TeamViewer Cloud Session Recording output directories.
File modifications in root-owned paths with timestamps correlating to active TeamViewer CSR sessions.
Unusual openat, rename, or symlink syscalls issued by non-root users against TeamViewer working directories.

Detection Strategies

Deploy Linux audit rules (auditd) to log symlink creation and file renames within TeamViewer CSR working directories.
Monitor process telemetry for the TeamViewer daemon writing to paths outside its expected recording output tree.
Correlate local user activity with privileged file operations performed by the TeamViewer process context.

Monitoring Recommendations

Enable eBPF-based filesystem telemetry to capture TOCTOU-style symlink race patterns on Linux endpoints.
Alert on any TeamViewer child process or file operation touching /etc, /usr, /root, or systemd unit directories.
Review TeamViewer logs for CSR session errors or unexpected path resolution failures that may indicate exploitation attempts.

How to Mitigate CVE-2026-92371

Immediate Actions Required

Upgrade TeamViewer Full Client and Host for Linux to version 15.82 or later on all affected systems.
Inventory Linux hosts running TeamViewer and identify installations with Cloud Session Recording enabled.
Restrict local shell access on hosts where TeamViewer runs with elevated privileges.

Patch Information

TeamViewer has released version 15.82 to address this vulnerability. Refer to the TeamViewer Security Bulletin TV-2026-1010 for release details and download instructions. Apply the update through your standard package management workflow and validate the running version after installation.

Workarounds

Disable the Cloud Session Recording (CSR) feature in TeamViewer configuration until patching is complete.
Enforce strict filesystem permissions on TeamViewer working directories to prevent local users from creating symlinks in monitored paths.
Limit interactive local user accounts on hosts running TeamViewer with elevated privileges to reduce exposure to the race condition.

bash

# Verify installed TeamViewer version on Linux
teamviewer --version

# Confirm the package meets the fixed release
dpkg -l | grep -i teamviewer   # Debian/Ubuntu
rpm -q teamviewer              # RHEL/Fedora/SUSE

# Temporary mitigation: stop the service until patched
sudo systemctl stop teamviewerd
sudo systemctl disable teamviewerd