A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute… (CVE-2026-19042)

CVE-2026-19042 is a command injection vulnerability affecting TeamViewer Full Client and Host for Linux before version 15.81.5. An attacker can remotely execute arbitrary commands in the context of the current user by delivering a crafted URL via the out-of-session chat feature. The attack requires the user to click the malicious link, enabling command execution. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands with the current user's privileges, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires user interaction (clicking a malicious link), which limits automatic exploitation.

A fix is available in TeamViewer version 15.81.5. Users and administrators should upgrade to version 15.81.5 or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official update.