TeamViewer published security bulletin TV-2026-1011 on 27 October 2026, fixing three client vulnerabilities rated up to CVSS 8.8. Affected builds are the Full Client, Host and Portable clients plus the Android Remote Control app below version 15.83.
What happened
CVE-2026-92372 (8.8) is an out-of-bounds write in the screen-image decoder of the Full Client on Linux and macOS. Crafted screen data sent during a remote-control session, or a malicious session recording (.tvs) that a user is persuaded to open, writes past the image buffer and can execute code.
CVE-2026-111585 (8.8) is an integer overflow in remote-control screen decompression that becomes a heap overflow when a user connects to an attacker-controlled or compromised host, causing a crash or code execution with the viewer's privileges.
CVE-2026-92374 (7.8) is macOS only: a race condition and weak symbolic link handling in the privileged helper let a local low-privilege user bypass installer package verification, install a malicious package, and escalate to root.
TeamViewer says it is not aware of active exploitation in the wild or of public proof-of-concept code for any of the three.
Who is affected
- TeamViewer Remote, Tensor and ONE clients below 15.83
- Full Client and Host on Linux and macOS for both code execution flaws
- Portable clients and the Android Remote Control app for CVE-2026-111585
- Legacy branches 15.64, 14.7 and 13.2, which need the maintenance builds published with the bulletin
What to do now
Move every TeamViewer client to 15.83, and replace legacy 15.64, 14.7 and 13.2 installs with the fixed builds named in bulletin TV-2026-1011.
- Start with unattended Host installs on servers and on machines that accept inbound sessions.
- Do not open .tvs session recordings that arrive from outside your organisation.
- Check the version on laptops that connect out to client or supplier sites, not only on your own machines.
- Where an update has to wait, restrict who can start a session to an unknown device.
What this means for South African businesses
TeamViewer is one of the remote-support tools that turns up in almost every South African SME and in most MSP toolkits, and unattended Host installs are routinely left on old builds for years because nobody owns the update. The realistic risk is not a stranger guessing a session ID; it is an attacker who already controls a machine your staff connect to, or a supplier sending a session recording that runs code when opened. Update both sides of the session, including the laptops used by outsourced IT.
Source: TeamViewer security bulletin TV-2026-1011.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.