CVE-2026-92368 in Full Client
Summary
by MITRE • 09/29/2026
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in TeamViewer Full Client and Host for Linux and macOS prior to version 15.82 represents a critical security flaw rooted in improper memory management during the processing of proprietary session recording files. Specifically, this is a heap-based buffer overflow that occurs when the application handles .tvs formatted data. The core technical issue stems from a size mismatch between the declared length of the recorded session data and the actual amount of data being decompressed or processed by the internal parser. When TeamViewer attempts to play or convert these recordings using the designated feature, it allocates a buffer based on an initial header value but fails to validate that this allocation is sufficient for the subsequent decompression process. This discrepancy leads to out-of-bounds heap writes, where data exceeds the boundaries of the allocated memory block and overwrites adjacent memory structures.
From a technical perspective, this flaw aligns with CWE-122, which describes a heap-based buffer overflow allowing an attacker to corrupt dynamic memory on the heap. The exploitation vector relies heavily on social engineering or file manipulation, as it requires convincing a user to open a specially crafted .tvs session recording file through the application interface. Once triggered, the malformed data causes the program to write beyond its allocated limits, potentially overwriting critical metadata such as function pointers, object headers, or exception handlers stored in adjacent heap regions. This corruption can be leveraged to redirect the flow of execution within the process memory space.
The operational impact of this vulnerability is severe, leading directly to arbitrary code execution with the privileges of the current user. Because TeamViewer often runs with elevated permissions depending on system configuration and host settings, successful exploitation could allow an attacker to gain full control over the affected machine. This includes the ability to install malware, exfiltrate sensitive data, establish persistent backdoors, or pivot into other network segments if the compromised host serves as a gateway. The attack falls under MITRE ATT&CK technique T1203, which covers exploitation for client execution, specifically targeting applications that process untrusted input files without adequate sanitization.
Mitigation strategies must prioritize immediate software updates and strict access controls. Users should upgrade TeamViewer to version 15.82 or later, where the developers have implemented proper bounds checking during the decompression of session recording data. Until patches are applied, organizations should restrict the ability of standard users to execute arbitrary code via file associations for .tvs files if possible, although this is often difficult in desktop environments. Additionally, deploying endpoint detection and response solutions that monitor for anomalous memory allocation patterns or unexpected process spawns following document interactions can help detect exploitation attempts in real time. Security awareness training should also emphasize the risks of opening session recordings from untrusted sources, as these files are designed to be interactive media containers rather than static documents.