CVE-2026-19042: TeamViewer Linux Chat Link Command Injection (and Sibling CVE-2026-16444)

A Linux TeamViewer Full Client or Host older than 15.81 will run a command as the current user if you click a crafted URL in out-of-session chat. That is CVE-2026-19042, TeamViewer bulletin TV-2026-1009, CVSS 8.8. The same 15.81 train also closes CVE-2026-16444 (TV-2026-1008): a path-traversal file write that needs someone already inside an authenticated remote session. Current Linux packages on TeamViewer's download CDN are teamviewer_15.81.5_amd64.deb and teamviewer-host_15.81.5_amd64.deb. Windows and macOS shops still need that 15.81 train for the sibling, even though the chat RCE is Linux-only.

Who is not in scope

Windows and macOS clients are not listed on TV-2026-1009. CVE-2026-19042 is Full Client and Host for Linux only. QuickSupport is not on 1009; it is on 1008 for the file-write sibling. Mobile apps and the browser client are not in either bulletin. TeamViewer DEX / 1E is a different product line. Sending an out-of-session chat message requires the attacker to be in the recipient's contact list, or the recipient to have explicitly enabled chat from users outside that list. That outside-contact setting is disabled by default, so a default Linux install that never added the sender and never flipped that setting is not on the 19042 path. CVE-2026-16444 is also not an unauthenticated internet bug: the writer has to already be an authenticated remote session participant using file transfer or the virtual file clipboard.

This is not TV-2026-1006. That June 29 bulletin was Windows and macOS Full Client 15.78 through 15.79.3. TeamViewer mitigated it server-side by disabling out-of-session chat for those builds. Today's Linux issue is a new client-side command injection, not that kill-switch.

What broke

TV-2026-1009, issued 26 August 2026, describes CWE-78 command injection in TeamViewer Full Client and Host for Linux prior to 15.81. A remote attacker sends a specially crafted URL through the out-of-session chat feature. Exploitation requires the user to click the malicious link. The command then runs in the context of the current user, not as a claimed root-only bug. TeamViewer rates it Important, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The PR:N vector still sits behind the contact-list / outside-chat gate above. At publication they report no public prior disclosure and no indication of exploitation in the wild. Credit: HeaZzy (Mathys KHALFA) and skav (Antoine RIEUL) via the bug bounty.

TV-2026-1008 is the sibling on the same day and the same 15.81 floor. Desktop clients fail to sanitize filenames from a remote peer before creating files. An authenticated session participant can write to unintended locations via file transfer or virtual file clipboard, and can potentially execute code as the affected user. This one is Full Client, Host, and QuickSupport on Windows, macOS, and Linux prior to 15.81. CVSS 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Credit: Jamir0quai and sam91281.

Both products named on the bulletins are TeamViewer Remote, Tensor, and ONE. The current-train floor is 15.81. The Linux debs TeamViewer actually serves today from download.teamviewer.com/download/linux/ redirect to 15.81.5. Guard's evidence pack for 19042 also lists 15.81.5 as the fixed version.

What this is not

This is not an unauthenticated internet worm, not a no-click bug, and not a Windows or macOS chat RCE. It is not known exploited. Clicking a chat link from someone who can already message you is the 19042 gate. Being in a live remote session is the 16444 gate. Do not treat a Linux-only headline as a reason to skip Windows and macOS fleets; they still have 16444 on the same upgrade.

How to check

On Linux Full Client or Host, print the installed version:

teamviewer version
# some installs accept teamviewer --version
# expect a 15.81 or later line, for example TeamViewer 15.81.5 (DEB)

Anything below 15.81 on the current train is the 19042/16444 window. If the box is still on 14.x, vendor 1009 lists Linux Full Client and Host v14 as fixed in 14.7.48838. If it is still on 13.x, 1008 lists Linux v13 as 13.2.153978. Bulletin 1009 repeats 14.7.48838 on the v13 Linux rows, which looks like a copy error against 1008's v13 Linux row; use 13.2.153978 for v13 Linux unless TeamViewer corrects 1009. Windows 7 and 8 clients are on a 15.64.7 floor for 16444 only.

How to fix

Upgrade TeamViewer Full Client and Host to 15.81 or later. Current Linux files from the official download CDN:

# Full Client (current CDN file)
# https://download.teamviewer.com/download/linux/teamviewer_amd64.deb
# -> teamviewer_15.81.5_amd64.deb
sudo apt install --only-upgrade teamviewer
# Host package (current CDN file teamviewer-host_15.81.5_amd64.deb)
sudo apt install --only-upgrade teamviewer-host

If you are not on the Linux.teamviewer.com apt repo, install the 15.81.5 debs from those official redirect URLs, or the matching packages for your distro. Windows and macOS Full Client, Host, and QuickSupport need the same 15.81 train for CVE-2026-16444. Temporary mitigation from 1009 if you cannot update Linux yet: do not click links received via chat in the affected clients. Hiding chat or keeping "accept messages from trusted accounts" / contacts-only as the default reduces 19042 delivery; it does not patch the client.

This article is the operator write-up for the 15.81 TeamViewer cluster. The HOL Guard evidence page is the source record for CVE-2026-19042; sibling evidence for CVE-2026-16444 is at HOL Guard CVE-2026-16444.

References

• TV-2026-1009 (CVE-2026-19042)
• TV-2026-1008 (CVE-2026-16444)
• TV-2026-1006 (June out-of-session chat, Windows/macOS, not this bug)
• CVE-2026-19042
• CVE-2026-16444
• Current Linux Full Client deb (redirects to 15.81.5)
• Current Linux Host deb (redirects to 15.81.5)