TeamViewer has released patches for two high-severity vulnerabilities in its remote access products that could allow attackers to execute arbitrary commands and write files outside intended directories.
The most critical flaw, identified as CVE-2026-19042 and assigned a CVSS score of 8.8, affects TeamViewer Remote, Tensor, and ONE Full Client and Host components on Linux prior to version 15.81.5. Successful exploitation grants command execution with the privileges of the currently logged-in user. To deliver the malicious message, an attacker must already appear in the victim's contact list or obtain explicit permission to send messages from external users.
The second vulnerability, CVE-2026-16444 with a CVSS score of 7.5, results from insufficient validation of file paths. It impacts TeamViewer clients for Windows, macOS, and Linux before version 15.81.5. During an active remote session, files transferred or content sent via the virtual clipboard may contain path traversal sequences, enabling writes outside the expected directory and potential code execution under the affected user's permissions.
Older product lines, including editions supporting Windows 7 and Windows 8 as well as legacy TeamViewer 13 and TeamViewer 14 releases, also received specific security updates. The vendor strongly recommends upgrading to the most recent available version to mitigate the risks.
No evidence of active exploitation of either vulnerability had been observed at the time the security bulletins were published.
