TeamViewer macOS CVE-2026-92374

Requires local access to a macOS host with an affected build of TeamViewer Full Client or Host installed (Host and Full Client before 15.83, Full Client/Host 14.7.x before 14.7.48868, and 13.2.x before 13.2.154007) so that the vulnerable privileged helper is present; the attacker needs an existing low-privilege account (PR:L) and must win the TOCTOU timing window between the helper's package verification and its use, combined with symbolic-link manipulation, to substitute a malicious installer package. Limiting factors: exploitation is local-only (no network path, AV:L), is confined to the macOS builds, depends on winning a race condition that may not succeed on every attempt, and is fully remediated only by updating to a fixed version per the vendor.

Signals point to a genuine but non-emergency local privilege-escalation issue. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects high confidentiality, integrity and availability impact but requires local access and existing low privileges, so this is not a remotely exploitable, internet-facing flaw. There is no CISA KEV listing and no EPSS score in the supplied data, so widespread or automated exploitation is not evidenced; exploitation status is 'no public exploit identified at time of analysis.' The strongest urgency signal is the vendor-derived priority 'this_week' (vuln.today) plus the fact that TeamViewer itself reported and patched it, which is consistent with a credible, fixable escalation path rather than an actively weaponized bug. One nuance to verify: the description calls this a TOCTOU race condition, yet the input CVSS rates attack complexity as low (AC:L); race conditions typically involve a timing window not fully under attacker control, so the real-world reliability of exploitation may be lower than AC:L implies. Net: a real priority to patch within the vendor's one-week window for macOS fleets, but not a drop-everything emergency given the local-only vector and absence of KEV/EPSS/PoC evidence.

A local attacker who already holds an unprivileged or standard account on a macOS host running TeamViewer Full Client or Host races the privileged helper between its verification of an installer package and its use of that package, swapping in a malicious package via symbolic-link manipulation. Because the vector is local (AV:L) with low privileges (PR:L) and no user interaction, success yields code execution as root. No public exploit code is identified in the available data; the timing-sensitive race may require multiple attempts.