CVE-2026-92368 is a heap-based buffer overflow vulnerability (CWE-122) in TeamViewer Full Client and Host for Linux and macOS prior to version 15.82. The vulnerability arises from a size mismatch during decompression of .tvs session recording files, causing out-of-bounds heap writes. Exploitation requires user interaction where the victim opens a maliciously crafted session recording file using the "Play or convert recorded session…" feature. Successful exploitation may allow arbitrary code execution with the privileges of the current user.

If exploited, this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running TeamViewer. This can lead to full compromise of the user's session and potentially further system compromise depending on user privileges. The CVSS v3.1 base score is 7.8 (high severity), reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

A fix is available in TeamViewer version 15.82 and later. Users should upgrade to version 15.82 or newer to remediate this vulnerability. Until patched, users should avoid opening untrusted or suspicious .tvs session recording files, especially those received from unverified sources.