DEV Community

Anoymask
Anoymask

Posted on

TeamViewer CVE-2026-111585 and Related Flaws: Viewer RCE Risks and macOS Local Privilege Escalation

#security #threatintel

1. Basic Information

  • Article Name: Security Update for Vulnerabilities in TeamViewer Clients
  • Publisher: TeamViewer
  • Published Date: October 27, 2026
  • Updated Date: October 28, 2026
  • Original Article: TeamViewer
  • Related Source: SecurityWeek
  • Related Malware: None identified
  • Related Threat Actor: None identified
  • Related CVEs: CVE-2026-111585, CVE-2026-92372, CVE-2026-92374
  • Affected Products: TeamViewer Full Client, TeamViewer Portable, TeamViewer Remote Control App for Android, TeamViewer macOS/Linux clients, TeamViewer Host (macOS/Linux)
  • Severity: High

2. Executive Summary

TeamViewer 15.83 addresses three vulnerabilities. CVE-2026-111585 affects screen decompression and can cause denial of service or, depending on the platform, potential code execution in a connected viewer. CVE-2026-92372 provides another screen-decoder execution path on Linux/macOS, while CVE-2026-92374 is a separate local privilege-escalation issue on macOS.

3. Attack Flow

Remote Host to Viewer RCE

  1. A support technician connects to an attacker-controlled or compromised TeamViewer host.
  2. The host sends a crafted screen image or compressed frame to the viewer.
  3. An integer overflow in CVE-2026-111585 or an out-of-bounds write in Linux/macOS CVE-2026-92372 corrupts the viewer memory.
  4. Upon successful exploitation, the attack proceeds to arbitrary code execution under the viewer process privileges.

Alternative Vectors: Malicious Recordings and macOS Local Escalation

These are independent vectors and do not necessarily occur in sequence:

  • CVE-2026-92372: When a Linux or macOS user opens a crafted .tvs recording file, malicious image data is passed to the decoder.
  • CVE-2026-92374: A low-privileged local user on macOS exploits a time-of-check time-of-use (TOCTOU) race combined with improper symlink handling in a privileged helper, bypassing package verification to install a malicious package as root.

4. Attacker Positioning and Execution Environment

  • A remote attacker controlling the destination host of a remote session.
  • A sender capable of supplying a crafted .tvs file, or a low-privileged local user on macOS.

5. Indicators for Victims and Administrators

Victims

  • The application may experience crashes, freezes, or appear as an unexpected process during a TeamViewer session.

Administrators

  • Indicators include viewer crash dumps, the connected host address, abnormal child processes spawned by the TeamViewer process, opened .tvs files, and installer file operations.

6. Conditions for Success and Failure

Success Conditions

  • Establishing a remote control session from a vulnerable TeamViewer client to an attacker-controlled or compromised host, or opening a crafted .tvs file.
  • For macOS CVE-2026-92374, a low-privileged local user bypasses package verification in the privileged helper using the TOCTOU race together with improper symlink handling in a separate attack path. No victim interaction is required (UI:N).

Failure Conditions and Mitigations

  • Update to TeamViewer 15.83 or the vendor-specified fixed legacy release.
  • Reduce exposure by using dedicated endpoints for remote support, isolating unknown hosts, and restricting .tvs file handling.

7. Impact of Successful Exploitation

  • Denial of service or potential remote code execution with viewer process privileges.
  • Potential compromise of credentials and customer environments through the support technician's endpoint.
  • Local root privilege escalation on macOS.

8. Observable Logs

  • Email: Receipt of crafted .tvs attachments or links.
  • Proxy / SWG / DNS: No issue-specific indicators specified.
  • Endpoint / EDR: TeamViewer process crashes, unexpected child processes, memory corruption, .tvs file opening, and macOS installer symlink or package operations.
  • Identity / IdP: Abnormal sessions or credential usage involving support accounts.
  • SaaS / Cloud: TeamViewer connection history, remote host IDs, and session metadata.
  • Network: Destination host of the session, TeamViewer traffic immediately preceding a crash, and subsequent outbound connections.

9. Determining Attack Success

  • User Interaction Confirmed: Assessment criteria: Establishing a remote session or opening a .tvs file confirms the required interaction for the decoder paths; it does not confirm code execution. Assess execution separately using crash dumps and process evidence. (Scope: TeamViewer viewer)

10. Investigation Playbook

  • Trigger: TeamViewer crashes, sessions with unknown hosts, crafted .tvs files, or unexpected child processes from the viewer.
  • Initial Checks: Verify the client version, platform, session peer, file hash, and crash timestamp.
  • Endpoint: Preserve crash dumps, TeamViewer logs, process trees, memory dumps, .tvs files, and installer artifacts.
  • Identity / Cloud: Review sessions and tokens for TeamViewer accounts and support credentials.
  • Follow-on: Track credential dumping, repository or customer system access, and lateral movement.
  • Containment: Apply client updates, isolate endpoints, terminate sessions, and rotate credentials based on evidence.
  • Classification: Distinguish between session connection, decoder crashes, code execution, and subsequent compromise.

11. Defense and Detection Ideas

  • Single Event: Alert on unexpected child processes spawned after a TeamViewer process crash.
  • Temporal Correlation: Correlate unknown host sessions, decoder crashes, child processes, and credential usage.
  • Hunting: Inventory clients older than version 15.83, opened .tvs files, and macOS installer anomalies. Check legacy client builds against the vendor's fixed legacy releases rather than treating every version below 15.83 as unpatched.
  • Logging Gap: The absence of TeamViewer connection metadata or crash dumps makes it difficult to determine causality with remote hosts.
  • Priority Controls: Prioritize patching, isolating support endpoints, validating remote hosts, and enforcing the principle of least privilege.

12. Facts, Inferences, and Hypotheses

Facts

  • CVE-2026-111585 is an integer overflow in remote-control screen decompression. When a malicious or compromised host sends crafted screen data to a viewer, it can cause a denial of service or, depending on the platform, potential remote code execution with viewer process privileges. The CVSS score is 8.8.
  • Exploitation requires the victim to establish a remote-control session with an attacker-controlled or compromised host.
  • CVE-2026-92372 is an out-of-bounds write in the macOS/Linux screen image decoder, which can lead to code execution via live crafted screen data or malicious .tvs recordings. The CVSS score is 8.8.
  • CVE-2026-92374 is a TOCTOU/symlink handling flaw in the macOS installer, allowing a low-privileged local user to install a malicious package and escalate to root. The CVSS score is 7.8.
  • These issues were addressed in TeamViewer 15.83 and corresponding legacy updates. TeamViewer is not aware of any active exploitation in the wild.

Inferences

  • Because support staff act as viewers interacting with remote hosts, their endpoints represent an attack surface. Consequently, connections cannot be assumed safe based solely on trust in the customer's device.

Hypotheses

No additional hypotheses. Unverified items are documented in the Unresolved Issues and Limitations section.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1203 Exploitation for Client Execution High Code execution within the viewer process via crafted live screen or recording data.
T1068 Exploitation for Privilege Escalation High Privilege escalation to root via local TOCTOU vulnerability on macOS.

14. Unresolved Issues and Limitations

  • No public exploits, active exploitation, or successful code execution examples have been confirmed.

15. Impact on SOCs and Organizations

Prioritize updating endpoints used by help desks, managed service providers (MSPs), and remote support personnel to version 15.83 or later, or the applicable vendor-specified fixed legacy release. Review practices regarding dedicated jump environments for connecting to unknown or potentially compromised hosts, enforce the principle of least privilege, and re-evaluate session recording handling.

16. Summary by Role

  • SOC Teams: Correlate TeamViewer crashes with connected destination hosts, crafted .tvs files, and viewer child processes.
  • Administrators: Update all applicable instances of TeamViewer Full Client, Portable, Host, and the Android Remote Control App.
  • Users: Avoid establishing remote sessions with unknown hosts or opening untrusted .tvs files.

Top comments (0)