TeamViewer Linux Client CVE-2026-19042

The out-of-session chat feature must be accessible to the attacker - this is a standard, default-enabled feature of TeamViewer that allows remote parties to send messages before a session is established. The attacker must know or discover the victim's TeamViewer ID to initiate chat. The victim must be running TeamViewer Full Client or Host on Linux at a version prior to 15.81.5 and must click the malicious URL link within the chat interface (CVSS UI:R). No attacker authentication is required (CVSS PR:N). Exploitation is strictly scoped to the Linux platform - Windows and macOS deployments are not affected per available data. The commands execute in the security context of the user running the TeamViewer client, so privilege escalation beyond that user's permissions is not inherent to this vulnerability.

The CVSS 8.8 score is well-supported by the attack characteristics: network-accessible (AV:N), low complexity (AC:L), no attacker authentication (PR:N), with only user interaction required (UI:R) and high impact across confidentiality, integrity, and availability. The UI:R factor is the primary risk reducer - the victim must click a link delivered via TeamViewer chat - but in managed service provider and remote support contexts, users are conditioned to interact with links sent through exactly this channel, making social engineering relatively low-effort. Even a mid-sized IT team managing Linux endpoints should treat this as urgent given that TeamViewer Host is frequently deployed as unattended infrastructure access, where the current-user context may carry elevated permissions. The Linux-only scope (Windows and macOS are not listed in CPE data) limits aggregate exposure. No CISA KEV listing is present and no POC has been identified, reducing the probability of opportunistic mass exploitation currently, though the simplicity of the injection vector means that technical barriers to exploit development are low. The absence of EPSS data in the provided intelligence means probabilistic exploitation likelihood cannot be precisely quantified.

An attacker identifies a target running an unpatched TeamViewer Full Client or Host on Linux and initiates an out-of-session chat, sending a URL crafted to embed shell metacharacters (e.g., a link formatted as 'teamviewer://action?arg=value;malicious_command'). When the victim clicks the link within the TeamViewer interface, the application passes the unsanitized URL to the Linux URL handler, causing the injected shell commands to execute in the context of the current user. No public exploit code has been identified at time of analysis, but the Linux URL-dispatch mechanism is well-understood and exploit development requires no specialized knowledge beyond familiarity with shell injection techniques.