TeamViewer Full Client EUVD-2026-111073

Exploitation requires the victim to use the TeamViewer Full Client (Linux or macOS) at a version below the fix and to take one of two actions: either open a specially crafted TeamViewer session recording (.tvs) file supplied by the attacker, or participate in a remote-control session into which the attacker injects crafted screen-image data (the latter implies the attacker controls or is present on the remote side of the session). The decisive technical prerequisite is the screen-image decoder's missing destination bounds check, which the crafted data triggers. The principal limiting factor is the required user interaction (UI:R) - there is no fully passive, zero-click path described. Unpatched versions are 13.2.x before 13.2.154007 (macOS)/13.2.154008 (Linux), 14.7.x before 14.7.48868, and all versions before 15.83.

This is a genuine high-priority issue rather than CVSS inflation, though it is not a drop-everything emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw (CWE-123 out-of-bounds write) whose only gating factor is user interaction. The vendor confirms a patch is available and the vuln.today decision label is 'this_week', signalling prompt but not immediate action. Two mitigating/clarifying signals temper the raw score: exploitation requires user interaction (UI:R), and there is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or at-scale exploitation. No public exploit or PoC reference is present in the input either. The AV:N rating is reasonable because one delivery path is a crafted .tvs recording file that can be sent to a victim, and the other is injection of crafted screen-image data into an established remote-control session; note the session path in practice implies the attacker already participates in or controls the remote side of a session, which is a practical constraint the CVSS vector does not capture. Net: treat as a prompt patch (this-week) priority for exposed TeamViewer Full Client installs, not as an under-active-exploitation emergency.

An attacker lures a victim into opening a maliciously crafted TeamViewer session recording (.tvs), or feeds crafted screen-image data into a remote-control session the victim is participating in; the decoder's missing destination bounds check produces an out-of-bounds write to the image buffer, corrupting memory to achieve arbitrary code execution in the victim's TeamViewer Full Client. No public exploit or PoC reference is present in the supplied data. The attack is low-complexity but requires the victim to take an action (open the file or engage in the session).