CVE-2026-19042: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in TeamViewer Full Client

This vulnerability (CVE-2026-19042) involves improper neutralization of special elements used in an OS command (CWE-78) in TeamViewer Full Client and Host for Linux prior to version 15.81.5. An attacker can remotely execute arbitrary OS commands in the context of the current user by sending a crafted URL via the out-of-session chat feature, which requires the user to click the link. The vulnerability affects versions 13.0, 14.0, and 15.0 of the software. There is no official remediation or patch information provided in the available data.

Successful exploitation allows remote attackers to execute arbitrary commands with the privileges of the current user, potentially leading to full compromise of the affected system. The vulnerability requires user interaction, limiting automated exploitation. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted or suspicious URLs received via the out-of-session chat feature in TeamViewer. Monitoring for suspicious activity related to this vector is advised.