Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    18 vulnerabilities found for Full Client by TeamViewer

    CVE-2026-92371 (GCVE-0-2026-92371)

    Vulnerability from nvd – Published: 2026-09-29 15:41 – Updated: 2026-09-29 15:41
    VLAI
    Title
    Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording
    Summary
    TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.
    Severity
    7 (High)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-59 - Improper link resolution before file access ('link following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    		Create a notification for this product.
    Credits
    We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.\u202f\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:41:12.493Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92371",
    "datePublished": "2026-09-29T15:41:12.493Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:41:12.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92370 (GCVE-0-2026-92370)

    Vulnerability from nvd – Published: 2026-09-29 15:42 – Updated: 2026-09-29 15:42
    VLAI
    Title
    Remote Session Access Control Bypass Leading to Remote Code Execution
    Summary
    An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    CWE
    • CWE-284 - Improper Access Control
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    Credits
    We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.\u0026nbsp;"
            }
          ],
          "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-113",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-113 Interface Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:42:27.283Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Session Access Control Bypass Leading to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92370",
    "datePublished": "2026-09-29T15:42:27.283Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:42:27.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92369 (GCVE-0-2026-92369)

    Vulnerability from nvd – Published: 2026-09-29 15:39 – Updated: 2026-09-29 15:39
    VLAI
    Title
    Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
    Summary
    TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    CWE
    • CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 , < 14.7.48855 (custom)
    Affected: 13.2.0 , < 13.2.36230 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 , < 14.7.48855 (custom)
    Affected: 13.2.0 , < 13.2.36230 (custom)
    		Create a notification for this product.
    Credits
    We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.\u0026nbsp;\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-29",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:53.082Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92369",
    "datePublished": "2026-09-29T15:39:53.082Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:39:53.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92368 (GCVE-0-2026-92368)

    Vulnerability from nvd – Published: 2026-09-29 15:40 – Updated: 2026-09-29 15:40
    VLAI
    Title
    Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution
    Summary
    TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    CWE
    • CWE-122 - Heap-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.70 , < 15.82 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.70 , < 15.82 (custom)
    		Create a notification for this product.
    Credits
    We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:40:30.767Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92368",
    "datePublished": "2026-09-29T15:40:30.767Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:40:30.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19743 (GCVE-0-2026-19743)

    Vulnerability from nvd – Published: 2026-09-29 15:39 – Updated: 2026-09-29 15:39
    VLAI
    Title
    Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
    Summary
    Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    Credits
    We thank Timo De Clercq & 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Timo De Clercq \u0026 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.\u202f\u0026nbsp;"
            }
          ],
          "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:11.503Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-19743",
    "datePublished": "2026-09-29T15:39:11.503Z",
    "dateReserved": "2026-08-13T13:55:15.000Z",
    "dateUpdated": "2026-09-29T15:39:11.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19042 (GCVE-0-2026-19042)

    Vulnerability from nvd – Published: 2026-08-26 09:16 – Updated: 2026-08-26 13:02
    VLAI
    Title
    Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
    Summary
    A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 13:01 UTC
    CWE
    • CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.81.5 (custom)
    Affected: 14.0 , < 14.7.488838 (custom)
    Affected: 13.0 , < 13.2.153978 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.81.5 (custom)
    Affected: 14.0 , < 14.7.488838 (custom)
    Affected: 13.0 , < 13.2.153978 (custom)
    		Create a notification for this product.
    Credits
    HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T13:01:56.742837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T13:02:05.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.81.5",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.488838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153978",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.81.5",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.488838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153978",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link.\u003c/p\u003e"
            }
          ],
          "value": "A command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T09:16:13.127Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1009/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eUpdate to the latest available client version.\u003c/div\u003e"
            }
          ],
          "value": "Update to the latest available client version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-19042",
    "datePublished": "2026-08-26T09:16:13.127Z",
    "dateReserved": "2026-08-06T06:13:29.904Z",
    "dateUpdated": "2026-08-26T13:02:05.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-41421 (GCVE-0-2025-41421)

    Vulnerability from nvd – Published: 2025-10-01 13:48 – Updated: 2025-10-01 13:59
    VLAI
    Title
    Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client
    Summary
    Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.
    Severity
    4.7 (Medium)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-10-01 13:59 UTC
    CWE
    • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 11.0.0 , < 15.70 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 11.0.0 , < 15.70 (custom)
    		Create a notification for this product.
    Credits
    @TwoSevenOneT (X) with ZeroSalarium.com
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T13:59:12.175007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T13:59:17.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.70",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.70",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "@TwoSevenOneT (X) with ZeroSalarium.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eImproper handling of symbolic links in the TeamViewer Full Client and Host for Windows \u2014 in versions prior to 15.70 of TeamViewer Remote and Tensor \u2014 allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.\u003c/span\u003e"
            }
          ],
          "value": "Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows \u2014 in versions prior to 15.70 of TeamViewer Remote and Tensor \u2014 allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T13:48:38.754Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1004/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2025-41421",
    "datePublished": "2025-10-01T13:48:38.754Z",
    "dateReserved": "2025-04-30T08:08:15.983Z",
    "dateUpdated": "2025-10-01T13:59:17.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-44002 (GCVE-0-2025-44002)

    Vulnerability from nvd – Published: 2025-08-26 11:05 – Updated: 2025-08-26 14:39
    VLAI
    Title
    Arbitrary File Creation via Symbolic Link leading to Denial-of-Service
    Summary
    Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-08-26 14:19 UTC
    CWE
    • CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 11.0.0 , < 15.69 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 11.0.0 , < 15.69 (custom)
    		Create a notification for this product.
    Credits
    Trend Micro Zero Day Initiative
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-44002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-26T14:19:37.473698Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-26T14:39:04.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.69",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.69",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Trend Micro Zero Day Initiative"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRace Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior \u003cspan style=\"background-color: rgba(0, 107, 255, 0.2);\"\u003ev\u003c/span\u003eersion 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to \u003cspan style=\"background-color: rgba(0, 107, 255, 0.2);\"\u003ea \u003c/span\u003edenial-of-service condition, via symbolic link manipulation during directory verification.\u003c/span\u003e"
            }
          ],
          "value": "Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-26T11:05:22.270Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1003/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary File Creation via Symbolic Link leading to Denial-of-Service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2025-44002",
    "datePublished": "2025-08-26T11:05:22.270Z",
    "dateReserved": "2025-04-30T08:08:15.979Z",
    "dateUpdated": "2025-08-26T14:39:04.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-36537 (GCVE-0-2025-36537)

    Vulnerability from nvd – Published: 2025-06-24 14:24 – Updated: 2025-06-24 15:31
    VLAI
    Title
    Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
    Summary
    Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
    Severity
    7 (High)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-06-24 14:45 UTC
    CWE
    • Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0.0 , < 15.67 (custom)
    Affected: 14.0.0 , < 14.7.48809 (custom)
    Affected: 13.0.0 , < 13.2.36227 (custom)
    Affected: 12.0.0 , < 12.0.259325 (custom)
    Affected: 11.0.0 , < 11.0.259324 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0.0 , < 15.67 (custom)
    Affected: 14.0.0 , < 14.7.48809 (custom)
    Affected: 13.0.0 , < 13.2.36227 (custom)
    Affected: 12.0.0 , < 12.0.259325 (custom)
    Affected: 11.0.0 , < 11.0.259324 (custom)
    		Create a notification for this product.
    TeamViewer Full Client (Win7/8) Affected: 15.0.0 , < 15.64.5 (custom)
    		Create a notification for this product.
    TeamViewer Host (Win7/8) Affected: 15.0.0 , < 15.64.5 (custom)
    		Create a notification for this product.
    Credits
    Giuliano Sanfins (0x_alibabas) from SiDi, working with Trend Micro Zero Day Initiativ
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36537",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-24T14:45:18.947774Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-24T15:31:17.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.67",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48809",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36227",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "12.0.259325",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.0.259324",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.67",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48809",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36227",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "12.0.259325",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.0.259324",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client (Win7/8)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.64.5",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host (Win7/8)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.64.5",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Giuliano Sanfins (0x_alibabas) from SiDi, working with Trend Micro Zero Day Initiativ"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIncorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-24T14:44:54.915Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1002/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2025-36537",
    "datePublished": "2025-06-24T14:24:08.394Z",
    "dateReserved": "2025-04-30T08:08:15.966Z",
    "dateUpdated": "2025-06-24T15:31:17.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2026-92370 (GCVE-0-2026-92370)

    Vulnerability from cvelistv5 – Published: 2026-09-29 15:42 – Updated: 2026-09-29 15:42
    VLAI
    Title
    Remote Session Access Control Bypass Leading to Remote Code Execution
    Summary
    An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    CWE
    • CWE-284 - Improper Access Control
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    Credits
    We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.\u0026nbsp;"
            }
          ],
          "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-113",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-113 Interface Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:42:27.283Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Session Access Control Bypass Leading to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92370",
    "datePublished": "2026-09-29T15:42:27.283Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:42:27.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92371 (GCVE-0-2026-92371)

    Vulnerability from cvelistv5 – Published: 2026-09-29 15:41 – Updated: 2026-09-29 15:41
    VLAI
    Title
    Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording
    Summary
    TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.
    Severity
    7 (High)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-59 - Improper link resolution before file access ('link following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    		Create a notification for this product.
    Credits
    We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.\u202f\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:41:12.493Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92371",
    "datePublished": "2026-09-29T15:41:12.493Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:41:12.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92368 (GCVE-0-2026-92368)

    Vulnerability from cvelistv5 – Published: 2026-09-29 15:40 – Updated: 2026-09-29 15:40
    VLAI
    Title
    Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution
    Summary
    TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    CWE
    • CWE-122 - Heap-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.70 , < 15.82 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.70 , < 15.82 (custom)
    		Create a notification for this product.
    Credits
    We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:40:30.767Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92368",
    "datePublished": "2026-09-29T15:40:30.767Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:40:30.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92369 (GCVE-0-2026-92369)

    Vulnerability from cvelistv5 – Published: 2026-09-29 15:39 – Updated: 2026-09-29 15:39
    VLAI
    Title
    Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
    Summary
    TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    CWE
    • CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 , < 14.7.48855 (custom)
    Affected: 13.2.0 , < 13.2.36230 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 , < 14.7.48855 (custom)
    Affected: 13.2.0 , < 13.2.36230 (custom)
    		Create a notification for this product.
    Credits
    We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.\u0026nbsp;\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-29",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:53.082Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92369",
    "datePublished": "2026-09-29T15:39:53.082Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-29T15:39:53.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19743 (GCVE-0-2026-19743)

    Vulnerability from cvelistv5 – Published: 2026-09-29 15:39 – Updated: 2026-09-29 15:39
    VLAI
    Title
    Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
    Summary
    Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.82 (custom)
    Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom)
    Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom)
    Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom)
    Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom)
    Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom)
    Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom)
    Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
    		Create a notification for this product.
    Credits
    We thank Timo De Clercq & 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Timo De Clercq \u0026 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.\u202f\u0026nbsp;"
            }
          ],
          "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:11.503Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-19743",
    "datePublished": "2026-09-29T15:39:11.503Z",
    "dateReserved": "2026-08-13T13:55:15.000Z",
    "dateUpdated": "2026-09-29T15:39:11.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19042 (GCVE-0-2026-19042)

    Vulnerability from cvelistv5 – Published: 2026-08-26 09:16 – Updated: 2026-08-26 13:02
    VLAI
    Title
    Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
    Summary
    A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 13:01 UTC
    CWE
    • CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0 , < 15.81.5 (custom)
    Affected: 14.0 , < 14.7.488838 (custom)
    Affected: 13.0 , < 13.2.153978 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0 , < 15.81.5 (custom)
    Affected: 14.0 , < 14.7.488838 (custom)
    Affected: 13.0 , < 13.2.153978 (custom)
    		Create a notification for this product.
    Credits
    HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T13:01:56.742837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T13:02:05.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.81.5",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.488838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153978",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.81.5",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.488838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153978",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link.\u003c/p\u003e"
            }
          ],
          "value": "A command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T09:16:13.127Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1009/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eUpdate to the latest available client version.\u003c/div\u003e"
            }
          ],
          "value": "Update to the latest available client version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-19042",
    "datePublished": "2026-08-26T09:16:13.127Z",
    "dateReserved": "2026-08-06T06:13:29.904Z",
    "dateUpdated": "2026-08-26T13:02:05.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-41421 (GCVE-0-2025-41421)

    Vulnerability from cvelistv5 – Published: 2025-10-01 13:48 – Updated: 2025-10-01 13:59
    VLAI
    Title
    Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client
    Summary
    Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.
    Severity
    4.7 (Medium)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-10-01 13:59 UTC
    CWE
    • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 11.0.0 , < 15.70 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 11.0.0 , < 15.70 (custom)
    		Create a notification for this product.
    Credits
    @TwoSevenOneT (X) with ZeroSalarium.com
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T13:59:12.175007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T13:59:17.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.70",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.70",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "@TwoSevenOneT (X) with ZeroSalarium.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eImproper handling of symbolic links in the TeamViewer Full Client and Host for Windows \u2014 in versions prior to 15.70 of TeamViewer Remote and Tensor \u2014 allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.\u003c/span\u003e"
            }
          ],
          "value": "Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows \u2014 in versions prior to 15.70 of TeamViewer Remote and Tensor \u2014 allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T13:48:38.754Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1004/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2025-41421",
    "datePublished": "2025-10-01T13:48:38.754Z",
    "dateReserved": "2025-04-30T08:08:15.983Z",
    "dateUpdated": "2025-10-01T13:59:17.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-44002 (GCVE-0-2025-44002)

    Vulnerability from cvelistv5 – Published: 2025-08-26 11:05 – Updated: 2025-08-26 14:39
    VLAI
    Title
    Arbitrary File Creation via Symbolic Link leading to Denial-of-Service
    Summary
    Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-08-26 14:19 UTC
    CWE
    • CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 11.0.0 , < 15.69 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 11.0.0 , < 15.69 (custom)
    		Create a notification for this product.
    Credits
    Trend Micro Zero Day Initiative
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-44002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-26T14:19:37.473698Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-26T14:39:04.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.69",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.69",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Trend Micro Zero Day Initiative"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRace Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior \u003cspan style=\"background-color: rgba(0, 107, 255, 0.2);\"\u003ev\u003c/span\u003eersion 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to \u003cspan style=\"background-color: rgba(0, 107, 255, 0.2);\"\u003ea \u003c/span\u003edenial-of-service condition, via symbolic link manipulation during directory verification.\u003c/span\u003e"
            }
          ],
          "value": "Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-26T11:05:22.270Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1003/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary File Creation via Symbolic Link leading to Denial-of-Service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2025-44002",
    "datePublished": "2025-08-26T11:05:22.270Z",
    "dateReserved": "2025-04-30T08:08:15.979Z",
    "dateUpdated": "2025-08-26T14:39:04.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-36537 (GCVE-0-2025-36537)

    Vulnerability from cvelistv5 – Published: 2025-06-24 14:24 – Updated: 2025-06-24 15:31
    VLAI
    Title
    Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
    Summary
    Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
    Severity
    7 (High)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-06-24 14:45 UTC
    CWE
    • Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    References
    Impacted products
    Vendor Product Version
    TeamViewer Full Client Affected: 15.0.0 , < 15.67 (custom)
    Affected: 14.0.0 , < 14.7.48809 (custom)
    Affected: 13.0.0 , < 13.2.36227 (custom)
    Affected: 12.0.0 , < 12.0.259325 (custom)
    Affected: 11.0.0 , < 11.0.259324 (custom)
    		Create a notification for this product.
    TeamViewer Host Affected: 15.0.0 , < 15.67 (custom)
    Affected: 14.0.0 , < 14.7.48809 (custom)
    Affected: 13.0.0 , < 13.2.36227 (custom)
    Affected: 12.0.0 , < 12.0.259325 (custom)
    Affected: 11.0.0 , < 11.0.259324 (custom)
    		Create a notification for this product.
    TeamViewer Full Client (Win7/8) Affected: 15.0.0 , < 15.64.5 (custom)
    		Create a notification for this product.
    TeamViewer Host (Win7/8) Affected: 15.0.0 , < 15.64.5 (custom)
    		Create a notification for this product.
    Credits
    Giuliano Sanfins (0x_alibabas) from SiDi, working with Trend Micro Zero Day Initiativ
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36537",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-24T14:45:18.947774Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-24T15:31:17.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.67",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48809",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36227",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "12.0.259325",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.0.259324",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.67",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48809",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36227",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "12.0.259325",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.0.259324",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client (Win7/8)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.64.5",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host (Win7/8)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.64.5",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Giuliano Sanfins (0x_alibabas) from SiDi, working with Trend Micro Zero Day Initiativ"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIncorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-24T14:44:54.915Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1002/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2025-36537",
    "datePublished": "2025-06-24T14:24:08.394Z",
    "dateReserved": "2025-04-30T08:08:15.966Z",
    "dateUpdated": "2025-06-24T15:31:17.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}