TeamViewer vulnerabilities and threats

CVE-2026-92370 is an improper access control vulnerability in TeamViewer Full Client and related modules on Windows, Linux, and macOS. It allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. This enables the attacker to perform actions explicitly denied by the victim's configuration, potentially leading to unauthorized actions and remote code execution. The vulnerability affects versions from 15.0 up to but not including 15.82. Multiple fixed versions are available across platforms.

CVE-2026-92371 is a vulnerability in TeamViewer Full Client and Host for Linux versions 15.0 up to but not including 15.82. It involves improper path validation in the Cloud Session Recording functionality, allowing a local authenticated attacker to exploit a race condition to perform privileged file operations in unintended locations. This flaw is fixed in version 15.82.

A heap-based buffer overflow vulnerability exists in TeamViewer Full Client and Host for Linux and macOS versions 15.70 up to but not including 15.82. The flaw occurs during the processing of .tvs session recording files due to a size mismatch in decompression, which can lead to out-of-bounds heap writes. An attacker who convinces a user to open a specially crafted session recording file via the "Play or convert recorded session…" feature could achieve arbitrary code execution with the current user's privileges.

CVE-2026-92369 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the TeamViewer Full Client and Host installer rollback mechanism on Windows. It affects versions prior to 15.82. A local low-privileged attacker can exploit this race condition by replacing rollback backup files in a user-writable temporary directory before they are restored by an elevated installer, potentially escalating privileges to NT AUTHORITY/SYSTEM. Exploitation requires precise timing during installation or update rollback.

CVE-2026-19743 is a path traversal vulnerability in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS versions prior to 15.82. It allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM or root) by sending crafted IPC commands. This vulnerability can lead to local privilege escalation.

CVE-2026-19042 is a command injection vulnerability in TeamViewer Full Client and Host for Linux versions 13.0, 14.0, and 15.0. It allows a remote attacker to execute arbitrary commands as the current user by sending a specially crafted URL through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link. The vulnerability has a high severity with a CVSS score of 8.8.

CVE-2026-16444 is a high-severity vulnerability in TeamViewer Desktop Clients prior to version 15.81.5. It involves improper neutralization of path traversal sequences, allowing an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. This can lead to arbitrary file write and potentially code execution with the privileges of the affected user.

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host.

A broken access control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain backend API endpoints do not correctly enforce authorization checks, allowing an authenticated user with low privileges to perform actions and access resources intended only for higher‑privileged roles. An attacker with low‑privileged credentials may exploit this to gain unauthorized access to administrative or sensitive functionality.

CVE-2026-2695 is a command injection vulnerability in TeamViewer DEX Platform On-Premises versions prior to 9.2. It arises from improper input validation that allows authenticated users with at least questioner privileges to inject commands in specific instructions. Successful exploitation could enable execution of elevated commands on devices connected to the platform. The vulnerability has a CVSS score of 6.3, indicating medium severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional access controls with “Allow after confirmation” configuration in a remote session. An exploit could result in unauthorized access prior to local confirmation. The user needs to be authenticated for the remote session via ID/password, Session Link, or Easy Access as a prerequisite to exploit this vulnerability.

A missing validation of a user-controlled value in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network attacker to tamper with log timestamps via crafted UDP Sync command. This could result in forged or nonsensical datetime prefixes and compromising log integrity and forensic correlation.

An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows a remote attacker to leak stack memory and cause a denial of service via a crafted request. The leaked stack memory could be used to bypass ASLR remotely and facilitate exploitation of other vulnerabilities on the affected system.

An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause information disclosure or denial-of-service via a special crafted packet. The leaked memory could be used to bypass ASLR and facilitate further exploitation.

An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network attacker to trigger a heap-based buffer overflow and cause a denial-of-service (service crash) via specially crafted UDP packets.

A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation.

A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause the NomadBranch.exe process to terminate via crafted requests. This can result in a denial-of-service condition of the Content Distribution Service.

A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause normally encrypted UDP traffic to be sent in cleartext. This can result in disclosure of sensitive information.

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction’s input field. Users of 1E Client version 24.5 or higher are not affected.

Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local attacker to delete protected system files via a crafted RPC control junction or symlink that is followed when the delete instruction executes.