01 · The Real Story
A manipulated video stream that overflows the projector's frame buffer when you look at it
The vulnerability is in the TeamViewer Full Client screen-image decoder for Linux and macOS prior to 15.83. The decoder that processes frames from a remote-control session or a saved .tvs recording lacks destination bounds checks. A malicious peer can send crafted screen-image data that writes past the image buffer and ultimately hijacks execution. Affected builds include TeamViewer Remote, Tensor, ONE, Full Client, and Host on affected platforms.
TeamViewer rates this High at 8.8, but that score is mostly theoretical for now. There is no public exploit, no known active exploitation, and EPSS is only 0.00426 (0.426%). The user-interaction requirement is real: the victim must either join a hostile remote-control session or open a malicious recording. Successful exploitation would be serious because the client often sits on support or administration endpoints, but the practical likelihood today is lower than the CVSS number suggests.
"No public exploit, but malicious screen streams or .tvs files can RCE TeamViewer Linux/macOS — patch now"
02 · The Attack Path
5 steps from start to impact.
STEP 01
Obtain or build a malicious screen-image generator
No named weaponized tool exists for this vulnerability yet. An attacker needs a custom generator that produces either a malicious
.tvs recording or a live screen-sharing stream containing malformed image frames. Development requires reversing the TeamViewer decoder and overcoming macOS/Linux memory protections.Conditions required:
- Vulnerable TeamViewer Full Client/Host on Linux or macOS prior to 15.83
- Attacker can craft malformed screen-image data or a malicious .tvs recording
Where this breaks in practice:
- No public PoC, so attackers must develop a reliable platform-specific memory-corruption exploit
- Modern macOS/Linux mitigations including ASLR, heap hardening, and pointer authentication may reduce reliability
Detection/coverage: No static signatures for an unknown custom exploit; repeated TeamViewer crashes may indicate probing.
STEP 02
Deliver the malicious session or .tvs file
For the live-session path, the attacker convinces the victim to join a remote-control session where the attacker shares the crafted screen. For the file path, the attacker delivers a
.tvs recording through email, download, or shared storage and persuades the victim to open it in TeamViewer. This is a social-engineering step rather than a network-driven exploit.Conditions required:
- Victim accepts or initiates a TeamViewer session with an attacker-controlled endpoint
- Or victim opens an attacker-supplied .tvs recording
Where this breaks in practice:
- Email gateways, endpoint protection, and user awareness can block or flag untrusted .tvs files
- The user must ignore warnings and join the session or open the file
Detection/coverage: Email gateway can flag known malicious attachments; EDR can log .tvs opens and unusual TeamViewer child processes.
STEP 03
Trigger the out-of-bounds write in the decoder
When malformed screen-image data reaches the vulnerable decoder, missing destination bounds checking allows a write past the end of the image buffer. The attacker aims for a write-what-where condition that corrupts an adjacent heap object or function pointer. Precise heap grooming and memory layout matter; many attempts will simply crash the client.
Conditions required:
- Malformed screen-image data is processed by the vulnerable decoder
- Attacker controls enough frame data to influence memory layout
Where this breaks in practice:
- Decoder may reject malformed frames, and non-public format details complicate reliable corruption
- ASLR and allocator randomness make one-shot exploitation unreliable
Detection/coverage: Current scanners are unlikely to flag this before exploitation; crash telemetry may reveal repeated TeamViewer crashes.
STEP 04
Hijack execution and run stage-two payload
Successful corruption redirects control flow to attacker-controlled code. The payload runs with the privileges of the TeamViewer process, typically the logged-in user on macOS and often the current user on Linux. The attacker can then establish persistence or drop a loader for further actions.
Conditions required:
- Out-of-bounds write achieves code execution
- Payload bypasses local security controls
Where this breaks in practice:
- TeamViewer does not need root/System in most configurations, limiting initial privilege
- macOS hardened runtime/notarization and Linux mandatory access controls may restrict suspicious child processes
Detection/coverage: EDR behavioural analytics should detect post-exploitation behavior such as spawned shells, persistence, or unusual network connections.
STEP 05
Pivot from the compromised endpoint
A compromised TeamViewer client can become a foothold for lateral movement. The impact depends heavily on the host's role: a standard desktop yields user data, while an IT support workstation with saved remote-control credentials or unattended access to servers can become a domain-wide bridge.
Conditions required:
- Compromised endpoint has valuable credentials, remote sessions, or access to the management plane
- Attacker can avoid raising alarms while moving laterally
Where this breaks in practice:
- MFA, privileged access management, and network segmentation limit lateral movement
- Most macOS/Linux TeamViewer clients are end-user boxes without administrative access to the fleet
Detection/coverage: SIEM/UEBA should flag anomalous remote-control or admin behavior after initial compromise.
03 · Compensating Control
1
HIGH 7.2→IGNORE 0.0
SEVERITY REDUCEDPush TeamViewer 15.83+ to every Linux and macOS Full Client/Host — This is the vendor fix and removes the vulnerable decoder. Deploy through MDM or endpoint management within the noisgate remediation SLA of 180 days; if active exploitation appears, treat as emergency within hours.
2
HIGH 7.2→MEDIUM 5.5
SEVERITY REDUCEDBlock untrusted .tvs files and restrict TeamViewer session initiation until patched — This breaks both user-interaction paths by preventing malicious recordings from reaching TeamViewer and limiting remote sessions to approved peers. Apply within the noisgate mitigation SLA of 30 days via email gateway rules, endpoint attachment policy, and TeamViewer allowlists.
3
HIGH 7.2→HIGH 7.0
Deploy EDR and monitor TeamViewer crash/child-process telemetry — This does not prevent the memory corruption, but gives responders detection signal for exploitation attempts and post-exploitation. Deploy within the 30-day mitigation SLA and tune alerts for TeamViewer spawning shells, loading unknown libraries, or repeatedly crashing on .tvs files.
What doesn't work
- Firewall blocks between VLANs won't stop the attack; TeamViewer peer-to-peer or relay connections use outbound HTTPS and may traverse perimeter.
- Patching Windows TeamViewer clients does not close this Linux/macOS decoder bug; the vulnerability is specific to those platforms.
- Disabling remote-control acceptance alone doesn't block malicious .tvs recordings opened from email or downloads.
04 · Intelligence Metadata
The supporting signals.
| In-the-wild status | None known. TeamViewer bulletin says no active exploitation at publication; Mallory reports no in-the-wild activity. |
|---|---|
| Proof-of-concept availability | No public PoC. VulDB states no exploit available; no named GitHub repos or pocindex entries surfaced in search results. |
| EPSS | 0.00426 (0.426%), 37th percentile per Mallory — low predicted exploitation likelihood. |
| KEV status | Not listed in CISA KEV; no active exploitation evidence. |
| CVSS interpretation | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Network vector but user interaction required, no privilege needed, unchanged scope, high impact. |
| Affected versions | TeamViewer Full Client and Host for Linux and macOS prior to 15.83; TeamViewer Remote, Tensor, and ONE clients included. |
| Fixed versions | 15.83 or later per TeamViewer bulletin TV-2026-1011. |
| Scanning/exposure | No mass-internet scanner data in sources; TeamViewer clients usually make outbound connections and are not bound to a well-known external port, limiting direct internet-wide discovery. |
| Disclosure date | 2026-10-27 |
| Reporting researcher/org | Not disclosed in TeamViewer bulletin or available sources. |
Sources.
05 · The Call
Final Verdict
= UNCHANGED to HIGH (7.2/10)
Why this verdict
- Baseline: TeamViewer CVSS 3.1 is 8.8 High; the attack is remote with no privileges, and impact is high once code runs.
- Friction de-rating: No public PoC, no known in-the-wild exploitation, and EPSS only 0.00426 (0.426%) subtract about 1.0 from baseline.
- Platform/user-context de-rating: The bug affects only Linux/macOS clients; most TeamViewer installs are Windows or standard user endpoints, and the client usually runs as the logged-in user rather than root/System. Subtract about 0.6.
- Role multiplier floor: TeamViewer is a remote-access tool; compromised support/admin endpoints can pivot to many downstream hosts, so the floor is HIGH, not MEDIUM. Final score 7.2.
Why not higher?
Not CRITICAL because it requires user interaction, has no public exploit or active exploitation, and is not a network-edge, identity, or hypervisor component. Even on a successful exploit, initial execution is usually user-level, requiring further steps for domain or fleet impact.
Why not lower?
Not MEDIUM because the product is a remote-control client often present on tech-support/admin endpoints; a successful RCE can expose stored TeamViewer sessions and saved credentials, enabling lateral movement. Social-engineering delivery matches real TeamViewer scam patterns, and there is no clean alternative beyond patching.
06 · Verification
Crowdsourced verification payload.
Run this on each affected Linux or macOS host that has TeamViewer Full Client or Host installed. Execute with bash check_teamviewer_cve_2026_92372.sh as any user with read access to the TeamViewer binary or app bundle; no special privileges are required. It prints PATCHED, VULNERABLE, or UNKNOWN.
#!/bin/bash
# CVE-2026-92372 TeamViewer Linux/macOS version check
# Run on target host: bash check_teamviewer_cve_2026_92372.sh
set -u
candidates=(
'/Applications/TeamViewer.app/Contents/Info.plist'
'/opt/teamviewer/tv_bin/teamviewer'
'/opt/teamviewer/teamviewer'
'/usr/bin/teamviewer'
)
found=''
for c in "${candidates[@]}"; do
if [ -e "$c" ]; then
found="$c"
break
fi
done
if [ -z "$found" ]; then
echo UNKNOWN
exit 0
fi
ver=''
case "$found" in
*Info.plist)
if command -v /usr/libexec/PlistBuddy >/dev/null 2>&1; then
ver=$(/usr/libexec/PlistBuddy -c 'Print CFBundleShortVersionString' "$found" 2>/dev/null)
fi
;;
*)
if [ -x "$found" ]; then
ver=$("$found" --version 2>/dev/null | head -n 1)
fi
;;
esac
if [ -z "$ver" ]; then
echo UNKNOWN
exit 0
fi
min='15.83'
if printf '%s\n%s\n' "$min" "$ver" | sort -V | head -n 1 | grep -q '^15\.83$'; then
echo PATCHED
exit 0
else
echo VULNERABLE
exit 1
fi