Command Injection in TeamViewer Clients for Linux through Chat Link Handling

CVE-ID

CVE-2026-19042

Description

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.

 

Sending a chat message requires the attacker to either be included in the recipient’s contact list or the recipient to have explicitly enabled chat messages from users outside their contact list. By default, this setting is disabled.

 

The vulnerability has been fixed with version 15.81.5 and additional versions listed below. We recommend updating to the latest available version.

 

At the time of publication, we are not aware of any prior public disclosure of this issue or any indication of exploitation in the wild.

CVSS3.1 Score

Base Score 8.8 (High)

CVSS3.1 Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem type

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')