Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

TeamViewer 15.83 fixes remote code execution in its clients and SYSTEM/root escalation in Remote Management add-ons

TeamViewer Remote, Tensor and ONE clients and Remote Management add-ons

On October 27 TeamViewer published two bulletins covering nine CVEs. TV-2026-1011 fixes two remote-code-execution bugs in TeamViewer clients rated CVSS 8.8: an out-of-bounds write in the screen-image decoder of the Full Client for Linux and macOS (CVE-2026-92372), reachable through crafted screen-image data in a remote-control session or a crafted .tvs session recording, and an integer overflow in remote-control screen processing in the Full Client, Portable and Android Remote Control app (CVE-2026-111585), triggered by connecting to an attacker-controlled or compromised host. Both need user interaction. It also fixes a macOS privileged-helper race (CVE-2026-92374) that lets a local user install a malicious package and get root. TV-2026-1012 fixes six local privilege escalation bugs (CVE-2026-92375, CVE-2026-92376, CVE-2026-92377, CVE-2026-111582, CVE-2026-111583, CVE-2026-111584) in the Remote Management Monitoring, Patch Management and Advanced Asset Management add-ons that can give a low-privileged local user SYSTEM or root. TeamViewer rates both bulletins Important and says it is not aware of exploitation in the wild. Update TeamViewer Full Client, Host and Portable to 15.83 (or the patched legacy builds 15.64.10, 14.7.48868 and 13.2.x); the add-on fixes (Monitoring 26.10.1, Patch Management 26.9.1) arrive by auto-update.

Why this severity: CVSS 3.1 up to 8.8 (High) for the client RCEs, 7.3 to 7.8 for the local privilege escalations; TeamViewer priority Important; no exploitation in the wild known at publication

Started
Oct 27, 2026
CVEs
CVE-2026-92372CVE-2026-111585CVE-2026-92374CVE-2026-92375CVE-2026-92376CVE-2026-92377CVE-2026-111582CVE-2026-111583CVE-2026-111584

Follow this incident

Discuss on X ↗

Affected

  • TeamViewer Full Client and Host before 15.83 (Windows, Linux, macOS)
  • TeamViewer Portable before 15.83
  • TeamViewer Remote Control app for Android before 15.83
  • Legacy TeamViewer 15.64, 14.7 and 13.2 builds before the patched maintenance releases
  • Remote Management Monitoring add-on before 26.10.1
  • Remote Management Patch Management add-on before 26.9.1 (24.12.5 for client 14.7)

Fixed in

  • TeamViewer Full Client, Host and Portable 15.83
  • TeamViewer Remote Control app for Android 15.83
  • Legacy 15.64.10 (Windows 7 and 8), 14.7.48868, 13.2.36231 (Windows), 13.2.154008 (Linux), 13.2.154007 (macOS)
  • Monitoring add-on 26.10.1 (auto-update)
  • Patch Management add-on 26.9.1, or 24.12.5 for client 14.7 (auto-update)

Timeline1

  1. TeamViewer publishes TV-2026-1011 (client RCEs CVE-2026-92372 and CVE-2026-111585 plus macOS root escalation CVE-2026-92374, fixed in 15.83) and TV-2026-1012 (six Remote Management add-on privilege escalations), both rated Important with no known exploitation.

Advisories3

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo