Refine your search
15 vulnerabilities found for Full Client by TeamViewer
CVE-2026-111585 (GCVE-0-2026-111585)
Vulnerability from cvelistv5
Published
2026-10-27 15:19
Modified
2026-10-27 15:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-190 - Integer overflow or wraparound
Summary
An integer overflow in the remote-control
screen processing component of TeamViewer clients (Full Client, Portable and Remote
Control App) prior to version 15.83 may allow a malicious remote host to cause
a denial of service or, depending on the platform, potentially execute
arbitrary code with the privileges of the viewer process. Exploitation requires
a user to establish a remote-control session to an attacker-controlled or
compromised host.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 0 < 15.83 Version: 15.64.0 (Legacy Windows 7 & 8) < 15.64.10 (Legacy Windows 7 & 8) Version: 14.7.0 (Windows) < 14.7.48868 (Windows) Version: 14.7.0 (Linux) < 14.7.48868 (Linux) Version: 14.7.0 (macOS) < 14.7.48868 (macOS) Version: 13.2.0 (Windows) < 13.2.36231 (Windows) Version: 13.2.0 (Linux) < 13.2.154008 (Linux) Version: 13.2.0 (macOS) < 13.2.154007 (macOS) |
||||||||||||
|
||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (Windows)",
"status": "affected",
"version": "14.7.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (macOS)",
"status": "affected",
"version": "14.7.0 (macOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.36231 (Windows)",
"status": "affected",
"version": "13.2.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "13.2.154008 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.154007 (macOS)",
"status": "affected",
"version": "13.2.0 (macOS)",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Portable",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "Remote Control",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Omri Dar"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn integer overflow in the remote-control\nscreen processing component of TeamViewer clients (Full Client, Portable and Remote\nControl App) prior to version 15.83 may allow a malicious remote host to cause\na denial of service or, depending on the platform, potentially execute\narbitrary code with the privileges of the viewer process. Exploitation requires\na user to establish a remote-control session to an attacker-controlled or\ncompromised host.\u003c/p\u003e"
}
],
"value": "An integer overflow in the remote-control\nscreen processing component of TeamViewer clients (Full Client, Portable and Remote\nControl App) prior to version 15.83 may allow a malicious remote host to cause\na denial of service or, depending on the platform, potentially execute\narbitrary code with the privileges of the viewer process. Exploitation requires\na user to establish a remote-control session to an attacker-controlled or\ncompromised host."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:19:40.571Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest available version."
}
],
"value": "Update to the latest available version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-111585",
"datePublished": "2026-10-27T15:19:40.571Z",
"dateReserved": "2026-10-16T13:05:08.747Z",
"dateUpdated": "2026-10-27T15:19:40.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111583 (GCVE-0-2026-111583)
Vulnerability from cvelistv5
Published
2026-10-27 15:15
Modified
2026-10-27 15:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
Improper access control in the installer
staging directory used by TeamViewer Full Client and Host prior to version
15.82 for Windows during installation of Advanced Asset Management allows a
local authenticated user with low privileges to execute arbitrary commands as
SYSTEM. An attacker can place a crafted installer options file that is
processed by the Advanced Asset Management installer during service activation.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 0 < 15.82 Version: 15.64.0 (Legacy windows 7 & 8) < 15.64.10 (Legacy windows 7 & 8) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy windows 7 \u0026 8)",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0x_alibabas (Giuliano Sanfins)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper access control in the installer\nstaging directory used by TeamViewer Full Client and Host prior to version\n15.82 for Windows during installation of Advanced Asset Management allows a\nlocal authenticated user with low privileges to execute arbitrary commands as\nSYSTEM. An attacker can place a crafted installer options file that is\nprocessed by the Advanced Asset Management installer during service activation.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Improper access control in the installer\nstaging directory used by TeamViewer Full Client and Host prior to version\n15.82 for Windows during installation of Advanced Asset Management allows a\nlocal authenticated user with low privileges to execute arbitrary commands as\nSYSTEM. An attacker can place a crafted installer options file that is\nprocessed by the Advanced Asset Management installer during service activation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:15:44.411Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest available version."
}
],
"value": "Update to the latest available version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-111583",
"datePublished": "2026-10-27T15:15:44.411Z",
"dateReserved": "2026-10-16T13:05:08.747Z",
"dateUpdated": "2026-10-27T15:15:44.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92377 (GCVE-0-2026-92377)
Vulnerability from cvelistv5
Published
2026-10-27 15:11
Modified
2026-10-27 15:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Summary
Improper access control in the Patch
Management update mechanism of TeamViewer Full Client and Host for Windows
prior to version 15.82 allows a local authenticated attacker with low
privileges to supply a signed executable through a forged IPC response and
cause it to load a malicious DLL from a user-writable temporary directory.
Successful exploitation results in arbitrary code execution with NT
AUTHORITY\SYSTEM privileges.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 0 < 15.82 Version: 15.64.0 (Legacy Windows 7 & 8) < 15.64.10 (Legacy Windows 7 & 8) Version: 14.7.0 < 14.7.48868 Version: 13.2.0 < 13.2.36231 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868",
"status": "affected",
"version": "14.7.0",
"versionType": "custom"
},
{
"lessThan": "13.2.36231",
"status": "affected",
"version": "13.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868",
"status": "affected",
"version": "14.7.0",
"versionType": "custom"
},
{
"lessThan": "13.2.36231",
"status": "affected",
"version": "13.2.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0x_alibabas (Giuliano Sanfins)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper access control in the Patch\nManagement update mechanism of TeamViewer Full Client and Host for Windows\nprior to version 15.82 allows a local authenticated attacker with low\nprivileges to supply a signed executable through a forged IPC response and\ncause it to load a malicious DLL from a user-writable temporary directory.\nSuccessful exploitation results in arbitrary code execution with NT\nAUTHORITY\\SYSTEM privileges.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Improper access control in the Patch\nManagement update mechanism of TeamViewer Full Client and Host for Windows\nprior to version 15.82 allows a local authenticated attacker with low\nprivileges to supply a signed executable through a forged IPC response and\ncause it to load a malicious DLL from a user-writable temporary directory.\nSuccessful exploitation results in arbitrary code execution with NT\nAUTHORITY\\SYSTEM privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:11:55.955Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest available version."
}
],
"value": "Update to the latest available version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92377",
"datePublished": "2026-10-27T15:11:55.955Z",
"dateReserved": "2026-09-16T07:16:01.957Z",
"dateUpdated": "2026-10-27T15:11:55.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92375 (GCVE-0-2026-92375)
Vulnerability from cvelistv5
Published
2026-10-27 15:10
Modified
2026-10-27 15:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-284 - Improper Access Control
Summary
An improper access control vulnerability in
the IPC communication between TeamViewer Full Client or Host prior to version
15.83 and the Remote Management Monitoring component prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute scripts as
SYSTEM/root.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 0 < 15.83 Version: 15.64.0 (Legacy Windows 7 & 8) < 15.64.10 (Legacy Windows 7 & 8) Version: 14.7.0 (Windows) < 14.7.48868 (Windows) Version: 14.7.0 (Linux) < 14.7.48868 (Linux) Version: 14.7.0 (macOS) < 14.7.48868 (macOS) Version: 13.2.0 (Windows) < 13.2.36231 (Windows) Version: 13.2.0 (Linux) < 13.2.154008 (Linux) Version: 13.2.0 (macOS) < 13.2.154007 (macOS) |
||||||||||||
|
||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (Windows)",
"status": "affected",
"version": "14.7.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (macOS)",
"status": "affected",
"version": "14.7.0 (macOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.36231 (Windows)",
"status": "affected",
"version": "13.2.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "13.2.154008 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.154007 (macOS)",
"status": "affected",
"version": "13.2.0 (macOS)",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (Windows)",
"status": "affected",
"version": "14.7.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (macOS)",
"status": "affected",
"version": "14.7.0 (macOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.36231 (Windows)",
"status": "affected",
"version": "13.2.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "13.2.154008 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.154007 (macOS)",
"status": "affected",
"version": "13.2.0 (macOS)",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"ITbrain_Monitoring_Service.exe",
"MonitoringDaemon",
"teamviewer-monitoringd"
],
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Remote Management - Monitoring",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "26.10.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0x_alibabas (Giuliano Sanfins)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn improper access control vulnerability in\nthe IPC communication between TeamViewer Full Client or Host prior to version\n15.83 and the Remote Management Monitoring component prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute scripts as\nSYSTEM/root.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "An improper access control vulnerability in\nthe IPC communication between TeamViewer Full Client or Host prior to version\n15.83 and the Remote Management Monitoring component prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute scripts as\nSYSTEM/root."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:10:09.611Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest available version."
}
],
"value": "Update to the latest available version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92375",
"datePublished": "2026-10-27T15:10:09.611Z",
"dateReserved": "2026-09-16T07:16:01.957Z",
"dateUpdated": "2026-10-27T15:10:09.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92374 (GCVE-0-2026-92374)
Vulnerability from cvelistv5
Published
2026-10-27 15:09
Modified
2026-10-27 15:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Summary
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 0 < 15.83 Version: 14.7.0 < 14.7.48868 Version: 13.2.0 < 13.2.154007 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.48868",
"status": "affected",
"version": "14.7.0",
"versionType": "custom"
},
{
"lessThan": "13.2.154007",
"status": "affected",
"version": "13.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.48868",
"status": "affected",
"version": "14.7.0",
"versionType": "custom"
},
{
"lessThan": "13.2.154007",
"status": "affected",
"version": "13.2.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.\u202f\u0026nbsp;"
}
],
"value": "A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:09:25.189Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest available version."
}
],
"value": "Update to the latest available version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92374",
"datePublished": "2026-10-27T15:09:25.189Z",
"dateReserved": "2026-09-16T07:16:01.956Z",
"dateUpdated": "2026-10-27T15:09:25.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92372 (GCVE-0-2026-92372)
Vulnerability from cvelistv5
Published
2026-10-27 15:08
Modified
2026-10-27 15:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-123 - Write-what-where condition
Summary
An out-of-bounds write vulnerability in the
screen-image decoder of TeamViewer Full Client for Linux and macOS prior to
version 15.83 allows a remote attacker to execute arbitrary code by supplying
crafted screen-image data during a remote-control session. The vulnerability
can also be exploited by persuading a user to open a specially crafted
TeamViewer session recording (.tvs). Missing destination bounds checking in the
decoder allows crafted screen-image data to cause an out-of-bounds write to the
image buffer. Exploitation requires user interaction.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 0 < 15.83 Version: 14.7.0 (Linux) < 14.7.48868 (Linux) Version: 14.7.0 (macOS) < 14.7.48868 (macOS) Version: 13.2.0 (Linux) < 13.2.154008 (Linux) Version: 13.2.0 (macOS) < 13.2.154007 (macOS) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS",
"Linux"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.83",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48868 (macOS)",
"status": "affected",
"version": "14.7.0 (macOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.154008 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.154007 (macOS)",
"status": "affected",
"version": "13.2.0 (macOS)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn out-of-bounds write vulnerability in the\nscreen-image decoder of TeamViewer Full Client for Linux and macOS prior to\nversion 15.83 allows a remote attacker to execute arbitrary code by supplying\ncrafted screen-image data during a remote-control session. The vulnerability\ncan also be exploited by persuading a user to open a specially crafted\nTeamViewer session recording (.tvs). Missing destination bounds checking in the\ndecoder allows crafted screen-image data to cause an out-of-bounds write to the\nimage buffer. Exploitation requires user interaction.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "An out-of-bounds write vulnerability in the\nscreen-image decoder of TeamViewer Full Client for Linux and macOS prior to\nversion 15.83 allows a remote attacker to execute arbitrary code by supplying\ncrafted screen-image data during a remote-control session. The vulnerability\ncan also be exploited by persuading a user to open a specially crafted\nTeamViewer session recording (.tvs). Missing destination bounds checking in the\ndecoder allows crafted screen-image data to cause an out-of-bounds write to the\nimage buffer. Exploitation requires user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-123",
"description": "CWE-123 Write-what-where condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:08:28.439Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest available version."
}
],
"value": "Update to the latest available version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92372",
"datePublished": "2026-10-27T15:08:28.439Z",
"dateReserved": "2026-09-16T07:16:01.956Z",
"dateUpdated": "2026-10-27T15:08:28.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92370 (GCVE-0-2026-92370)
Vulnerability from cvelistv5
Published
2026-09-29 15:42
Modified
2026-09-30 15:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-284 - Improper Access Control
Summary
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 15.0 < 15.82 Version: 15.64.0 (Legacy Windows 7 & 8) < 15.64.8 (Legacy Windows 7 & 8) Version: 14.7.0 (Windows) < 14.7.48855 (Windows) Version: 13.2.0 (Windows) < 13.2.36230 (Windows) Version: 14.7.0 (Linux) < 14.7.48855 (Linux) Version: 13.2.0 (Linux) < 13.2.153995 (Linux) Version: 14.7.0 (MacOS) < 14.7.48855 (MacOS) Version: 13.2.0 (MacOS) < 13.2.153994 (MacOS) |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T15:12:37.475626Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:28:18.681Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Windows)",
"status": "affected",
"version": "14.7.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "13.2.36230 (Windows)",
"status": "affected",
"version": "13.2.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.153995 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (MacOS)",
"status": "affected",
"version": "14.7.0 (MacOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.153994 (MacOS)",
"status": "affected",
"version": "13.2.0 (MacOS)",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Windows)",
"status": "affected",
"version": "14.7.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "13.2.36230 (Windows)",
"status": "affected",
"version": "13.2.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.153995 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (MacOS)",
"status": "affected",
"version": "14.7.0 (MacOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.153994 (MacOS)",
"status": "affected",
"version": "13.2.0 (MacOS)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.\u0026nbsp;"
}
],
"value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system."
}
],
"impacts": [
{
"capecId": "CAPEC-113",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-113 Interface Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:42:27.283Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version."
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Session Access Control Bypass Leading to Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92370",
"datePublished": "2026-09-29T15:42:27.283Z",
"dateReserved": "2026-09-16T07:16:01.956Z",
"dateUpdated": "2026-09-30T15:28:18.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92371 (GCVE-0-2026-92371)
Vulnerability from cvelistv5
Published
2026-09-29 15:41
Modified
2026-09-30 15:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Summary
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 15.0 < 15.82 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T15:12:52.300273Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:28:18.820Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.\u202f\u0026nbsp;"
}
],
"value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system."
}
],
"impacts": [
{
"capecId": "CAPEC-27",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:41:12.493Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version."
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92371",
"datePublished": "2026-09-29T15:41:12.493Z",
"dateReserved": "2026-09-16T07:16:01.956Z",
"dateUpdated": "2026-09-30T15:28:18.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92368 (GCVE-0-2026-92368)
Vulnerability from cvelistv5
Published
2026-09-29 15:40
Modified
2026-09-30 15:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-122 - Heap-based buffer overflow
Summary
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 15.70 < 15.82 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T15:15:23.642523Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:28:18.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS",
"Linux"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.70",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS",
"Linux"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.70",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user\u0026nbsp;"
}
],
"value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:40:30.767Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version."
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92368",
"datePublished": "2026-09-29T15:40:30.767Z",
"dateReserved": "2026-09-16T07:16:01.956Z",
"dateUpdated": "2026-09-30T15:28:18.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92369 (GCVE-0-2026-92369)
Vulnerability from cvelistv5
Published
2026-09-29 15:39
Modified
2026-09-30 15:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Summary
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 15.0 < 15.82 Version: 15.64.0 (Legacy Windows 7 & 8) < 15.64.8 (Legacy Windows 7 & 8) Version: 14.7.0 < 14.7.48855 Version: 13.2.0 < 13.2.36230 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T15:15:35.268669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:28:19.100Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855",
"status": "affected",
"version": "14.7.0",
"versionType": "custom"
},
{
"lessThan": "13.2.36230",
"status": "affected",
"version": "13.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855",
"status": "affected",
"version": "14.7.0",
"versionType": "custom"
},
{
"lessThan": "13.2.36230",
"status": "affected",
"version": "13.2.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.\u0026nbsp;\u0026nbsp;"
}
],
"value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update."
}
],
"impacts": [
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:39:53.082Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version."
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-92369",
"datePublished": "2026-09-29T15:39:53.082Z",
"dateReserved": "2026-09-16T07:16:01.956Z",
"dateUpdated": "2026-09-30T15:28:19.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19743 (GCVE-0-2026-19743)
Vulnerability from cvelistv5
Published
2026-09-29 15:39
Modified
2026-09-30 15:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 15.0 < 15.82 Version: 15.64.0 (Legacy Windows 7 & 8) < 15.64.8 (Legacy Windows 7 & 8) Version: 14.7.0 (Windows) < 14.7.48855 (Windows) Version: 13.2.0 (Windows) < 13.2.36230 (Windows) Version: 14.7.0 (Linux) < 14.7.48855 (Linux) Version: 13.2.0 (Linux) < 13.2.153995 (Linux) Version: 14.7.0 (MacOS) < 14.7.48855 (MacOS) Version: 13.2.0 (MacOS) < 13.2.153994 (MacOS) |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T15:20:48.791393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:28:19.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Windows)",
"status": "affected",
"version": "14.7.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "13.2.36230 (Windows)",
"status": "affected",
"version": "13.2.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.153995 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (MacOS)",
"status": "affected",
"version": "14.7.0 (MacOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.153994 (MacOS)",
"status": "affected",
"version": "13.2.0 (MacOS)",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.82",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
"status": "affected",
"version": "15.64.0 (Legacy Windows 7 \u0026 8)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Windows)",
"status": "affected",
"version": "14.7.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "13.2.36230 (Windows)",
"status": "affected",
"version": "13.2.0 (Windows)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (Linux)",
"status": "affected",
"version": "14.7.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "13.2.153995 (Linux)",
"status": "affected",
"version": "13.2.0 (Linux)",
"versionType": "custom"
},
{
"lessThan": "14.7.48855 (MacOS)",
"status": "affected",
"version": "14.7.0 (MacOS)",
"versionType": "custom"
},
{
"lessThan": "13.2.153994 (MacOS)",
"status": "affected",
"version": "13.2.0 (MacOS)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We thank Timo De Clercq \u0026 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.\u202f\u0026nbsp;"
}
],
"value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:39:11.503Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version."
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-19743",
"datePublished": "2026-09-29T15:39:11.503Z",
"dateReserved": "2026-08-13T13:55:15.000Z",
"dateUpdated": "2026-09-30T15:28:19.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19042 (GCVE-0-2026-19042)
Vulnerability from cvelistv5
Published
2026-08-26 09:16
Modified
2026-08-26 13:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Summary
A command injection vulnerability in TeamViewer Full
Client and Host for Linux prior to version 15.81.5 allows a remote attacker to
execute arbitrary commands in the context of the current user via a specially
crafted URL sent through the out-of-session chat feature. Exploitation requires
user interaction by clicking the malicious link.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 15.0 < 15.81.5 Version: 14.0 < 14.7.488838 Version: 13.0 < 13.2.153978 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T13:01:56.742837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:02:05.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.81.5",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "14.7.488838",
"status": "affected",
"version": "14.0",
"versionType": "custom"
},
{
"lessThan": "13.2.153978",
"status": "affected",
"version": "13.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.81.5",
"status": "affected",
"version": "15.0",
"versionType": "custom"
},
{
"lessThan": "14.7.488838",
"status": "affected",
"version": "14.0",
"versionType": "custom"
},
{
"lessThan": "13.2.153978",
"status": "affected",
"version": "13.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link.\u003c/p\u003e"
}
],
"value": "A command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T09:16:13.127Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1009/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eUpdate to the latest available client version.\u003c/div\u003e"
}
],
"value": "Update to the latest available client version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2026-19042",
"datePublished": "2026-08-26T09:16:13.127Z",
"dateReserved": "2026-08-06T06:13:29.904Z",
"dateUpdated": "2026-08-26T13:02:05.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41421 (GCVE-0-2025-41421)
Vulnerability from cvelistv5
Published
2025-10-01 13:48
Modified
2025-10-01 13:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Summary
Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 11.0.0 < 15.70 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-01T13:59:12.175007Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-01T13:59:17.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.70",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.70",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "@TwoSevenOneT (X) with ZeroSalarium.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eImproper handling of symbolic links in the TeamViewer Full Client and Host for Windows \u2014 in versions prior to 15.70 of TeamViewer Remote and Tensor \u2014 allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.\u003c/span\u003e"
}
],
"value": "Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows \u2014 in versions prior to 15.70 of TeamViewer Remote and Tensor \u2014 allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-01T13:48:38.754Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1004/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version.\n\n\u003cbr\u003e"
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2025-41421",
"datePublished": "2025-10-01T13:48:38.754Z",
"dateReserved": "2025-04-30T08:08:15.983Z",
"dateUpdated": "2025-10-01T13:59:17.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-44002 (GCVE-0-2025-44002)
Vulnerability from cvelistv5
Published
2025-08-26 11:05
Modified
2025-08-26 14:39
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Summary
Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 11.0.0 < 15.69 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-44002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-26T14:19:37.473698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T14:39:04.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.69",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.69",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRace Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior \u003cspan style=\"background-color: rgba(0, 107, 255, 0.2);\"\u003ev\u003c/span\u003eersion 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to \u003cspan style=\"background-color: rgba(0, 107, 255, 0.2);\"\u003ea \u003c/span\u003edenial-of-service condition, via symbolic link manipulation during directory verification.\u003c/span\u003e"
}
],
"value": "Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification."
}
],
"impacts": [
{
"capecId": "CAPEC-27",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T11:05:22.270Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1003/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version.\n\n\u003cbr\u003e"
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary File Creation via Symbolic Link leading to Denial-of-Service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2025-44002",
"datePublished": "2025-08-26T11:05:22.270Z",
"dateReserved": "2025-04-30T08:08:15.979Z",
"dateUpdated": "2025-08-26T14:39:04.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-36537 (GCVE-0-2025-36537)
Vulnerability from cvelistv5
Published
2025-06-24 14:24
Modified
2025-06-24 15:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
Summary
Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TeamViewer | Full Client |
Version: 15.0.0 < 15.67 Version: 14.0.0 < 14.7.48809 Version: 13.0.0 < 13.2.36227 Version: 12.0.0 < 12.0.259325 Version: 11.0.0 < 11.0.259324 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-36537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-24T14:45:18.947774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:31:17.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Full Client",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.67",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
},
{
"lessThan": "14.7.48809",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
},
{
"lessThan": "13.2.36227",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
},
{
"lessThan": "12.0.259325",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
},
{
"lessThan": "11.0.259324",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Host",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.67",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
},
{
"lessThan": "14.7.48809",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
},
{
"lessThan": "13.2.36227",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
},
{
"lessThan": "12.0.259325",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
},
{
"lessThan": "11.0.259324",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Full Client (Win7/8)",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.64.5",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Host (Win7/8)",
"vendor": "TeamViewer",
"versions": [
{
"lessThan": "15.64.5",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Giuliano Sanfins (0x_alibabas) from SiDi, working with Trend Micro Zero Day Initiativ"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIncorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e"
}
],
"value": "Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T14:44:54.915Z",
"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"shortName": "TV"
},
"references": [
{
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1002/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the latest version."
}
],
"value": "Update to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
"assignerShortName": "TV",
"cveId": "CVE-2025-36537",
"datePublished": "2025-06-24T14:24:08.394Z",
"dateReserved": "2025-04-30T08:08:15.966Z",
"dateUpdated": "2025-06-24T15:31:17.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}