Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-19042

Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TV

Description

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TeamViewer Full Client

Default version status: unaffected

  • 15.0 to < 15.81.5affected
  • 14.0 to < 14.7.488838affected
  • 13.0 to < 13.2.153978affected

TeamViewer Host

Default version status: unaffected

  • 15.0 to < 15.81.5affected
  • 14.0 to < 14.7.488838affected
  • 13.0 to < 13.2.153978affected

References