CVE-2026-92374 Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

High 7.8 Published 27 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-92374?

CVE-2026-92374 is a high-severity vulnerability in TeamViewer Full Client, published on 27 Oct 2026.

Official description

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

Weakness: CWE-367

Which versions are affected by CVE-2026-92374?

How do I fix CVE-2026-92374?

No fix has been published for CVE-2026-92374 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-92374 being exploited?

There is no known exploitation of CVE-2026-92374 in the wild and no public exploit code.

Sources

Also known as GHSA-mx87-284w-9374.