CVE-2026-92372
Received
Received - Intake
Out-of-Bounds Write in TeamViewer Full Client for Linux and macOS
Vulnerability report for CVE-2026-92372, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-27
Last updated on: 2026-10-27
Assigner: TeamViewer Germany GmbH
Description
Description
An out-of-bounds write vulnerability in the
screen-image decoder of TeamViewer Full Client for Linux and macOS prior to
version 15.83 allows a remote attacker to execute arbitrary code by supplying
crafted screen-image data during a remote-control session. The vulnerability
can also be exploited by persuading a user to open a specially crafted
TeamViewer session recording (.tvs). Missing destination bounds checking in the
decoder allows crafted screen-image data to cause an out-of-bounds write to the
image buffer. Exploitation requires user interaction.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TeamViewer | Full Client | 0 |
| TeamViewer | Full Client | 14.7.0 (Linux) |
| TeamViewer | Full Client | 14.7.0 (macOS) |
| TeamViewer | Full Client | 13.2.0 (Linux) |
| TeamViewer | Full Client | 13.2.0 (macOS) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-123 | Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow. |
