TeamViewer has 27 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 14 in the last 90 days against 0 in the 90 before. The busiest recent month was December 2025 with 13. The median CVSS is 7.3 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-20 (11) and CWE-77 (6). Most affected products: digital_employee_experience (13), Full Client (11), Remote Management - Monitoring (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 14 prev 0
Products
- digital_employee_experience 13
- Full Client 11
- Remote Management - Monitoring 2
- TeamViewer Remote - Patch Management 1
Worst active — by depth score
CVE-2026-92372High· 8.8Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution48CVE-2026-111585High· 8.8Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow48CVE-2026-92370High· 8.8An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session esta…48CVE-2025-44016High· 8.8A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request48CVE-2026-92377High· 7.8Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows43
TeamViewer vulnerabilities
CVEs affecting TeamViewer, newest first. Open any entry for full detail, references, and exploit status.
27 CVEsRSS
CVE-2026-111585High· 8.8Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow
An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, dependin…
CVE-2026-111584High· 7.3Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows
A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privile…
CVE-2026-111582High· 7.3Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows
A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Explo…
CVE-2026-92377High· 7.8Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows
Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forg…
CVE-2026-111583High· 7.3Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows
Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges …
CVE-2026-92376High· 7.8Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows
Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC b…
CVE-2026-92375High· 7.8Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring
An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker…
CVE-2026-92374High· 7.8Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to…
CVE-2026-92372High· 8.8Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution
An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remo…
CVE-2026-92371High· 7.0TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent fil…
CVE-2026-92370High· 8.8An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session esta…
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session esta…
CVE-2026-92369High· 7.3TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary …
CVE-2026-92368High· 7.8TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data c…
CVE-2026-19743High· 7.8Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated…
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated…
CVE-2025-64995Medium· 6.5A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the…
CVE-2025-64994Medium· 6.5A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers wit…
CVE-2025-64993Medium· 6.8A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges …
CVE-2025-64992Medium· 6.8A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25. Improper input validation, allowing authenticated attackers with Actioner priv…
CVE-2025-64991Medium· 6.8A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15. Improper input validation, allowing authenticated attackers with Actioner privileg…
CVE-2025-64990Medium· 6.8A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior V21.1
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior V21.1. Improper input validation, allowing authenticated attackers with Acti…
CVE-2025-64989High· 7.2A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attacker…
CVE-2025-64988High· 7.2A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation, allowing authenticated attackers with Actioner…
CVE-2025-64987High· 7.2A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation, allowing authenticated attackers with Actioner pri…
CVE-2025-64986High· 7.2A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation, allowing authenticated attacker…
CVE-2025-46266Medium· 4.3A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to coerce the service into transmitting data to an arbitrary internal IP…
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to coerce the service into transmitting data to an arbitrary internal IP…
CVE-2025-44016High· 8.8A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request
A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing …
CVE-2025-12687Medium· 6.5A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to cause a denial of service (application crash) via a crafted command, …
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to cause a denial of service (application crash) via a crafted command, …