8.8High
CVE-2026-19042Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
Description
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.
Weakness (CWE):
CWE-78
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| TeamViewer | Full Client | 15.0 – < 15.81.5, 14.0 – < 14.7.488838, 13.0 – < 13.2.153978 | |
| TeamViewer | Host | 15.0 – < 15.81.5, 14.0 – < 14.7.488838, 13.0 – < 13.2.153978 |