Vulnerability · Published Aug 26, 2026 · Assigned by TV
CVE-2026-19042Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
High 8.8
In plain English
A high-severity OS command injection in Full Client from TeamViewer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.8%top 21.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TeamViewer | Full Client | 15.0 – before 15.81.514.0 – before 14.7.48883813.0 – before 13.2.153978 |
| TeamViewer | Host | 15.0 – before 15.81.514.0 – before 14.7.48883813.0 – before 13.2.153978 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H