Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-92377 (GCVE-0-2026-92377)

Vulnerability from nvd – Published: 2026-10-27 15:11 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows

Summary

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.36231 (custom)
TeamViewer	Host	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.36231 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92377",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:49.190319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:59.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper access control in the Patch\nManagement update mechanism of TeamViewer Full Client and Host for Windows\nprior to version 15.82 allows a local authenticated attacker with low\nprivileges to supply a signed executable through a forged IPC response and\ncause it to load a malicious DLL from a user-writable temporary directory.\nSuccessful exploitation results in arbitrary code execution with NT\nAUTHORITY\\SYSTEM privileges.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Improper access control in the Patch\nManagement update mechanism of TeamViewer Full Client and Host for Windows\nprior to version 15.82 allows a local authenticated attacker with low\nprivileges to supply a signed executable through a forged IPC response and\ncause it to load a malicious DLL from a user-writable temporary directory.\nSuccessful exploitation results in arbitrary code execution with NT\nAUTHORITY\\SYSTEM privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:11:55.955Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92377",
    "datePublished": "2026-10-27T15:11:55.955Z",
    "dateReserved": "2026-09-16T07:16:01.957Z",
    "dateUpdated": "2026-11-04T20:27:59.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92376 (GCVE-0-2026-92376)

Vulnerability from nvd – Published: 2026-10-27 15:11 – Updated: 2026-11-04 20:28

Title

Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

Summary

Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-287 - Improper Authentication

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	Remote Management - Monitoring	Affected: 0 , < 26.10.1 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:47.901061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:07.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ITbrain_Monitoring_Service.exe"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "Remote Management - Monitoring",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper authentication in the\ninter-process communication (IPC) mechanism of TeamViewer Remote Management\nMonitoring for Windows prior to version 26.10.1 allows a local authenticated\nattacker with low privileges to impersonate the IPC broker and cause the\nMonitoring service to execute arbitrary code with NT AUTHORITY\\SYSTEM\nprivileges, resulting in local privilege escalation.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Improper authentication in the\ninter-process communication (IPC) mechanism of TeamViewer Remote Management\nMonitoring for Windows prior to version 26.10.1 allows a local authenticated\nattacker with low privileges to impersonate the IPC broker and cause the\nMonitoring service to execute arbitrary code with NT AUTHORITY\\SYSTEM\nprivileges, resulting in local privilege escalation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:11:08.772Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92376",
    "datePublished": "2026-10-27T15:11:08.772Z",
    "dateReserved": "2026-09-16T07:16:01.957Z",
    "dateUpdated": "2026-11-04T20:28:07.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92375 (GCVE-0-2026-92375)

Vulnerability from nvd – Published: 2026-10-27 15:10 – Updated: 2026-11-04 20:28

Title

Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring

Summary

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-284 - Improper Access Control

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48868 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Windows) , < 13.2.36231 (Windows) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)
TeamViewer	Host	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48868 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Windows) , < 13.2.36231 (Windows) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)
TeamViewer	Remote Management - Monitoring	Affected: 0 , < 26.10.1 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:46.571044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:13.182Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ITbrain_Monitoring_Service.exe",
            "MonitoringDaemon",
            "teamviewer-monitoringd"
          ],
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Remote Management - Monitoring",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn improper access control vulnerability in\nthe IPC communication between TeamViewer Full Client or Host prior to version\n15.83 and the Remote Management Monitoring component prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute scripts as\nSYSTEM/root.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "An improper access control vulnerability in\nthe IPC communication between TeamViewer Full Client or Host prior to version\n15.83 and the Remote Management Monitoring component prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute scripts as\nSYSTEM/root."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:10:09.611Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92375",
    "datePublished": "2026-10-27T15:10:09.611Z",
    "dateReserved": "2026-09-16T07:16:01.957Z",
    "dateUpdated": "2026-11-04T20:28:13.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92374 (GCVE-0-2026-92374)

Vulnerability from nvd – Published: 2026-10-27 15:09 – Updated: 2026-11-04 20:28

Title

Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

Summary

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-367 - Time-of-check time-of-use (TOCTOU) race condition

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.154007 (custom)
TeamViewer	Host	Affected: 0 , < 15.83 (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.154007 (custom)

Credits

HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:44.775397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:19.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.\u202f\u0026nbsp;"
            }
          ],
          "value": "A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:09:25.189Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92374",
    "datePublished": "2026-10-27T15:09:25.189Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-11-04T20:28:19.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92372 (GCVE-0-2026-92372)

Vulnerability from nvd – Published: 2026-10-27 15:08 – Updated: 2026-11-04 20:28

Title

Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

Summary

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-123 - Write-what-where condition

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)

Credits

HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:43.318702Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:25.133Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn out-of-bounds write vulnerability in the\nscreen-image decoder of TeamViewer Full Client for Linux and macOS prior to\nversion 15.83 allows a remote attacker to execute arbitrary code by supplying\ncrafted screen-image data during a remote-control session. The vulnerability\ncan also be exploited by persuading a user to open a specially crafted\nTeamViewer session recording (.tvs). Missing destination bounds checking in the\ndecoder allows crafted screen-image data to cause an out-of-bounds write to the\nimage buffer. Exploitation requires user interaction.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "An out-of-bounds write vulnerability in the\nscreen-image decoder of TeamViewer Full Client for Linux and macOS prior to\nversion 15.83 allows a remote attacker to execute arbitrary code by supplying\ncrafted screen-image data during a remote-control session. The vulnerability\ncan also be exploited by persuading a user to open a specially crafted\nTeamViewer session recording (.tvs). Missing destination bounds checking in the\ndecoder allows crafted screen-image data to cause an out-of-bounds write to the\nimage buffer. Exploitation requires user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-123",
              "description": "CWE-123 Write-what-where condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:08:28.439Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92372",
    "datePublished": "2026-10-27T15:08:28.439Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-11-04T20:28:25.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111585 (GCVE-0-2026-111585)

Vulnerability from nvd – Published: 2026-10-27 15:19 – Updated: 2026-11-04 20:27

Title

Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

Summary

An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-190 - Integer overflow or wraparound

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48868 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Windows) , < 13.2.36231 (Windows) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)
TeamViewer	Portable	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom)
TeamViewer	Remote Control	Affected: 0 , < 15.83 (custom)

Credits

Omri Dar

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111585",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:54.382172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:33.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Portable",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Android"
          ],
          "product": "Remote Control",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Omri Dar"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn integer overflow in the remote-control\nscreen processing component of TeamViewer clients (Full Client, Portable and Remote\nControl App) prior to version 15.83 may allow a malicious remote host to cause\na denial of service or, depending on the platform, potentially execute\narbitrary code with the privileges of the viewer process. Exploitation requires\na user to establish a remote-control session to an attacker-controlled or\ncompromised host.\u003c/p\u003e"
            }
          ],
          "value": "An integer overflow in the remote-control\nscreen processing component of TeamViewer clients (Full Client, Portable and Remote\nControl App) prior to version 15.83 may allow a malicious remote host to cause\na denial of service or, depending on the platform, potentially execute\narbitrary code with the privileges of the viewer process. Exploitation requires\na user to establish a remote-control session to an attacker-controlled or\ncompromised host."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:19:40.571Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111585",
    "datePublished": "2026-10-27T15:19:40.571Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:33.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111584 (GCVE-0-2026-111584)

Vulnerability from nvd – Published: 2026-10-27 15:18 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

Summary

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	TeamViewer Remote - Patch Management	Affected: 0 , < 26.9.1 (custom) Affected: 0 (Legacy version for v14.7 client) , < 24.12.5 (Legacy version for v14.7 client) (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:53.098105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:40.604Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "RM_PatchManagement_Service.exe"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "TeamViewer Remote - Patch Management",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "24.12.5 (Legacy version for v14.7 client)",
              "status": "affected",
              "version": "0 (Legacy version for v14.7 client)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA race condition in the installation\nprocess of TeamViewer Remote Management - Patch Management for Windows prior to\nversion 26.9.1 allows a local authenticated attacker with low privileges to\nexecute arbitrary code with elevated privileges by replacing the service\nexecutable in an insufficiently protected temporary directory during Patch\nManagement activation.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "A race condition in the installation\nprocess of TeamViewer Remote Management - Patch Management for Windows prior to\nversion 26.9.1 allows a local authenticated attacker with low privileges to\nexecute arbitrary code with elevated privileges by replacing the service\nexecutable in an insufficiently protected temporary directory during Patch\nManagement activation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:18:50.953Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111584",
    "datePublished": "2026-10-27T15:18:50.953Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:40.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111583 (GCVE-0-2026-111583)

Vulnerability from nvd – Published: 2026-10-27 15:15 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows

Summary

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy windows 7 & 8) , < 15.64.10 (Legacy windows 7 & 8) (custom)
TeamViewer	Host	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:51.784070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:47.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy windows 7 \u0026 8)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper access control in the installer\nstaging directory used by TeamViewer Full Client and Host prior to version\n15.82 for Windows during installation of Advanced Asset Management allows a\nlocal authenticated user with low privileges to execute arbitrary commands as\nSYSTEM. An attacker can place a crafted installer options file that is\nprocessed by the Advanced Asset Management installer during service activation.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Improper access control in the installer\nstaging directory used by TeamViewer Full Client and Host prior to version\n15.82 for Windows during installation of Advanced Asset Management allows a\nlocal authenticated user with low privileges to execute arbitrary commands as\nSYSTEM. An attacker can place a crafted installer options file that is\nprocessed by the Advanced Asset Management installer during service activation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:15:44.411Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111583",
    "datePublished": "2026-10-27T15:15:44.411Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:47.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111582 (GCVE-0-2026-111582)

Vulnerability from nvd – Published: 2026-10-27 15:13 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows

Summary

A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	Remote Management - Monitoring	Affected: 0 , < 26.10.1 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:50.481849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:53.351Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "MonitoringInstaller.exe"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "Remote Management - Monitoring",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA DLL loading vulnerability in the\nTeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute arbitrary\ncode with elevated privileges. Exploitation requires user interaction.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "A DLL loading vulnerability in the\nTeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute arbitrary\ncode with elevated privileges. Exploitation requires user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:13:13.769Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111582",
    "datePublished": "2026-10-27T15:13:13.769Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:53.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92371 (GCVE-0-2026-92371)

Vulnerability from nvd – Published: 2026-09-29 15:41 – Updated: 2026-09-30 15:28

Title

Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording

Summary

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:12 UTC

CWE

CWE-59 - Improper link resolution before file access ('link following')

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom)

Credits

We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:12:52.300273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:18.820Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.\u202f\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:41:12.493Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92371",
    "datePublished": "2026-09-29T15:41:12.493Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:18.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92370 (GCVE-0-2026-92370)

Vulnerability from nvd – Published: 2026-09-29 15:42 – Updated: 2026-09-30 15:28

Title

Remote Session Access Control Bypass Leading to Remote Code Execution

Summary

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:12 UTC

CWE

CWE-284 - Improper Access Control

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)

Credits

We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:12:37.475626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:18.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.\u0026nbsp;"
            }
          ],
          "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-113",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-113 Interface Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:42:27.283Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Session Access Control Bypass Leading to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92370",
    "datePublished": "2026-09-29T15:42:27.283Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:18.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92369 (GCVE-0-2026-92369)

Vulnerability from nvd – Published: 2026-09-29 15:39 – Updated: 2026-09-30 15:28

Title

Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation

Summary

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:15 UTC

CWE

CWE-367 - Time-of-check time-of-use (TOCTOU) race condition

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48855 (custom) Affected: 13.2.0 , < 13.2.36230 (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48855 (custom) Affected: 13.2.0 , < 13.2.36230 (custom)

Credits

We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:15:35.268669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:19.100Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.\u0026nbsp;\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-29",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:53.082Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92369",
    "datePublished": "2026-09-29T15:39:53.082Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:19.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92368 (GCVE-0-2026-92368)

Vulnerability from nvd – Published: 2026-09-29 15:40 – Updated: 2026-09-30 15:28

Title

Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution

Summary

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:15 UTC

CWE

CWE-122 - Heap-based buffer overflow

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.70 , < 15.82 (custom)
TeamViewer	Host	Affected: 15.70 , < 15.82 (custom)

Credits

We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:15:23.642523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:18.950Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:40:30.767Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92368",
    "datePublished": "2026-09-29T15:40:30.767Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:18.950Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19743 (GCVE-0-2026-19743)

Vulnerability from nvd – Published: 2026-09-29 15:39 – Updated: 2026-09-30 15:28

Title

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients

Summary

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:20 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)

Credits

We thank Timo De Clercq & 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19743",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:20:48.791393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:19.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Timo De Clercq \u0026 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.\u202f\u0026nbsp;"
            }
          ],
          "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:11.503Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-19743",
    "datePublished": "2026-09-29T15:39:11.503Z",
    "dateReserved": "2026-08-13T13:55:15.000Z",
    "dateUpdated": "2026-09-30T15:28:19.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19042 (GCVE-0-2026-19042)

Vulnerability from nvd – Published: 2026-08-26 09:16 – Updated: 2026-08-26 13:02

Title

Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling

Summary

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 13:01 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.81.5 (custom) Affected: 14.0 , < 14.7.488838 (custom) Affected: 13.0 , < 13.2.153978 (custom)
TeamViewer	Host	Affected: 15.0 , < 15.81.5 (custom) Affected: 14.0 , < 14.7.488838 (custom) Affected: 13.0 , < 13.2.153978 (custom)

Credits

HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T13:01:56.742837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T13:02:05.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.81.5",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.488838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153978",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.81.5",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.488838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153978",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link.\u003c/p\u003e"
            }
          ],
          "value": "A command injection vulnerability in TeamViewer Full\nClient and Host for Linux prior to version 15.81.5 allows a remote attacker to\nexecute arbitrary commands in the context of the current user via a specially\ncrafted URL sent through the out-of-session chat feature. Exploitation requires\nuser interaction by clicking the malicious link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T09:16:13.127Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1009/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eUpdate to the latest available client version.\u003c/div\u003e"
            }
          ],
          "value": "Update to the latest available client version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-19042",
    "datePublished": "2026-08-26T09:16:13.127Z",
    "dateReserved": "2026-08-06T06:13:29.904Z",
    "dateUpdated": "2026-08-26T13:02:05.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16444 (GCVE-0-2026-16444)

Vulnerability from nvd – Published: 2026-08-26 09:10 – Updated: 2026-08-27 03:58

Title

Improper Validation of File Paths in TeamViewer Desktop Clients

Summary

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of the affected user.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 00:00 UTC

CWE

CWE-73 - External control of file name or path

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/de/resources/trust-cen…

Impacted products

8 products

Vendor	Product	Version
TeamViewer	Full Client, Host, QuickSupport & Portable	Affected: 15.0 , < 15.81.5 (custom)
TeamViewer	Full Client, Host, QuickSupport & Portable (for Windows 7 & 8)	Affected: 15.64.0 , < 15.64.7 (custom)
TeamViewer	Full Client, Host, QuickSupport (v14 for Windows)	Affected: 14.0 , < 14.7.48833 (custom)
TeamViewer	Full Client, Host, QuickSupport (v14 for Linux)	Affected: 14.0 , < 14.7.48838 (custom)
TeamViewer	Full Client, Host, QuickSupport (v14 for macOS)	Affected: 14.0 , < 14.7.48838 (custom)
TeamViewer	Full Client, Host, QuickSupport & Portable (v13 for Windows)	Affected: 13.0 , < 13.2.36229 (custom)
TeamViewer	Full Client, Host, QuickSupport (v13 for Linux)	Affected: 13.0 , < 13.2.153978 (custom)
TeamViewer	Full Client, Host, QuickSupport (v13 for macOS)	Affected: 13.0 , < 13.2.153981 (custom)

Credits

Jamir0quai & sam91281

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16444",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T03:58:23.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux"
          ],
          "product": "Full Client, Host, QuickSupport \u0026 Portable",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.81.5",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client, Host, QuickSupport \u0026 Portable (for Windows 7 \u0026 8)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.64.7",
              "status": "affected",
              "version": "15.64.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client, Host, QuickSupport (v14 for Windows)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "14.7.48833",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client, Host, QuickSupport (v14 for Linux)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "14.7.48838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Full Client, Host, QuickSupport (v14 for macOS)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "14.7.48838",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client, Host, QuickSupport \u0026 Portable (v13 for Windows)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "13.2.36229",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client, Host, QuickSupport (v13 for Linux)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "13.2.153978",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Full Client, Host, QuickSupport (v13 for macOS)",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "13.2.153981",
              "status": "affected",
              "version": "13.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jamir0quai \u0026 sam91281"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper\nneutralization of path traversal sequences in TeamViewer Desktop Clients prior\nVersion 15.81.5 allows an authenticated remote session participant to write files\nto unintended locations on the local file system via file transfer or virtual\nfile clipboard mechanisms. An attacker can leverage this behavior to achieve\narbitrary file write and potentially execute code with the privileges of the\naffected user.\u003c/p\u003e"
            }
          ],
          "value": "Improper\nneutralization of path traversal sequences in TeamViewer Desktop Clients prior\nVersion 15.81.5 allows an authenticated remote session participant to write files\nto unintended locations on the local file system via file transfer or virtual\nfile clipboard mechanisms. An attacker can leverage this behavior to achieve\narbitrary file write and potentially execute code with the privileges of the\naffected user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External control of file name or path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T09:10:16.193Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "url": "https://www.teamviewer.com/de/resources/trust-center/security-bulletins/tv-2026-1008/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the last available client version."
            }
          ],
          "value": "Update to the last available client version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Validation of File Paths in TeamViewer Desktop Clients",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-16444",
    "datePublished": "2026-08-26T09:10:16.193Z",
    "dateReserved": "2026-07-21T07:42:28.976Z",
    "dateUpdated": "2026-08-27T03:58:23.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111585 (GCVE-0-2026-111585)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:19 – Updated: 2026-11-04 20:27

Title

Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

Summary

An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-190 - Integer overflow or wraparound

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48868 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Windows) , < 13.2.36231 (Windows) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)
TeamViewer	Portable	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom)
TeamViewer	Remote Control	Affected: 0 , < 15.83 (custom)

Credits

Omri Dar

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111585",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:54.382172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:33.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Portable",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Android"
          ],
          "product": "Remote Control",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Omri Dar"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn integer overflow in the remote-control\nscreen processing component of TeamViewer clients (Full Client, Portable and Remote\nControl App) prior to version 15.83 may allow a malicious remote host to cause\na denial of service or, depending on the platform, potentially execute\narbitrary code with the privileges of the viewer process. Exploitation requires\na user to establish a remote-control session to an attacker-controlled or\ncompromised host.\u003c/p\u003e"
            }
          ],
          "value": "An integer overflow in the remote-control\nscreen processing component of TeamViewer clients (Full Client, Portable and Remote\nControl App) prior to version 15.83 may allow a malicious remote host to cause\na denial of service or, depending on the platform, potentially execute\narbitrary code with the privileges of the viewer process. Exploitation requires\na user to establish a remote-control session to an attacker-controlled or\ncompromised host."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:19:40.571Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111585",
    "datePublished": "2026-10-27T15:19:40.571Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:33.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111584 (GCVE-0-2026-111584)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:18 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

Summary

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	TeamViewer Remote - Patch Management	Affected: 0 , < 26.9.1 (custom) Affected: 0 (Legacy version for v14.7 client) , < 24.12.5 (Legacy version for v14.7 client) (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:53.098105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:40.604Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "RM_PatchManagement_Service.exe"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "TeamViewer Remote - Patch Management",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "24.12.5 (Legacy version for v14.7 client)",
              "status": "affected",
              "version": "0 (Legacy version for v14.7 client)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA race condition in the installation\nprocess of TeamViewer Remote Management - Patch Management for Windows prior to\nversion 26.9.1 allows a local authenticated attacker with low privileges to\nexecute arbitrary code with elevated privileges by replacing the service\nexecutable in an insufficiently protected temporary directory during Patch\nManagement activation.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "A race condition in the installation\nprocess of TeamViewer Remote Management - Patch Management for Windows prior to\nversion 26.9.1 allows a local authenticated attacker with low privileges to\nexecute arbitrary code with elevated privileges by replacing the service\nexecutable in an insufficiently protected temporary directory during Patch\nManagement activation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:18:50.953Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111584",
    "datePublished": "2026-10-27T15:18:50.953Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:40.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111583 (GCVE-0-2026-111583)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:15 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows

Summary

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy windows 7 & 8) , < 15.64.10 (Legacy windows 7 & 8) (custom)
TeamViewer	Host	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:51.784070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:47.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy windows 7 \u0026 8)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper access control in the installer\nstaging directory used by TeamViewer Full Client and Host prior to version\n15.82 for Windows during installation of Advanced Asset Management allows a\nlocal authenticated user with low privileges to execute arbitrary commands as\nSYSTEM. An attacker can place a crafted installer options file that is\nprocessed by the Advanced Asset Management installer during service activation.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Improper access control in the installer\nstaging directory used by TeamViewer Full Client and Host prior to version\n15.82 for Windows during installation of Advanced Asset Management allows a\nlocal authenticated user with low privileges to execute arbitrary commands as\nSYSTEM. An attacker can place a crafted installer options file that is\nprocessed by the Advanced Asset Management installer during service activation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:15:44.411Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111583",
    "datePublished": "2026-10-27T15:15:44.411Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:47.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111582 (GCVE-0-2026-111582)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:13 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows

Summary

A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	Remote Management - Monitoring	Affected: 0 , < 26.10.1 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:50.481849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:53.351Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "MonitoringInstaller.exe"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "Remote Management - Monitoring",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA DLL loading vulnerability in the\nTeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute arbitrary\ncode with elevated privileges. Exploitation requires user interaction.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "A DLL loading vulnerability in the\nTeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute arbitrary\ncode with elevated privileges. Exploitation requires user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:13:13.769Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-111582",
    "datePublished": "2026-10-27T15:13:13.769Z",
    "dateReserved": "2026-10-16T13:05:08.747Z",
    "dateUpdated": "2026-11-04T20:27:53.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92377 (GCVE-0-2026-92377)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:11 – Updated: 2026-11-04 20:27

Title

Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows

Summary

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.36231 (custom)
TeamViewer	Host	Affected: 0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.36231 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92377",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:49.190319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:27:59.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper access control in the Patch\nManagement update mechanism of TeamViewer Full Client and Host for Windows\nprior to version 15.82 allows a local authenticated attacker with low\nprivileges to supply a signed executable through a forged IPC response and\ncause it to load a malicious DLL from a user-writable temporary directory.\nSuccessful exploitation results in arbitrary code execution with NT\nAUTHORITY\\SYSTEM privileges.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Improper access control in the Patch\nManagement update mechanism of TeamViewer Full Client and Host for Windows\nprior to version 15.82 allows a local authenticated attacker with low\nprivileges to supply a signed executable through a forged IPC response and\ncause it to load a malicious DLL from a user-writable temporary directory.\nSuccessful exploitation results in arbitrary code execution with NT\nAUTHORITY\\SYSTEM privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:11:55.955Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92377",
    "datePublished": "2026-10-27T15:11:55.955Z",
    "dateReserved": "2026-09-16T07:16:01.957Z",
    "dateUpdated": "2026-11-04T20:27:59.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92376 (GCVE-0-2026-92376)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:11 – Updated: 2026-11-04 20:28

Title

Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

Summary

Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-287 - Improper Authentication

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	Remote Management - Monitoring	Affected: 0 , < 26.10.1 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:47.901061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:07.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ITbrain_Monitoring_Service.exe"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "Remote Management - Monitoring",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper authentication in the\ninter-process communication (IPC) mechanism of TeamViewer Remote Management\nMonitoring for Windows prior to version 26.10.1 allows a local authenticated\nattacker with low privileges to impersonate the IPC broker and cause the\nMonitoring service to execute arbitrary code with NT AUTHORITY\\SYSTEM\nprivileges, resulting in local privilege escalation.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Improper authentication in the\ninter-process communication (IPC) mechanism of TeamViewer Remote Management\nMonitoring for Windows prior to version 26.10.1 allows a local authenticated\nattacker with low privileges to impersonate the IPC broker and cause the\nMonitoring service to execute arbitrary code with NT AUTHORITY\\SYSTEM\nprivileges, resulting in local privilege escalation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:11:08.772Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92376",
    "datePublished": "2026-10-27T15:11:08.772Z",
    "dateReserved": "2026-09-16T07:16:01.957Z",
    "dateUpdated": "2026-11-04T20:28:07.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92375 (GCVE-0-2026-92375)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:10 – Updated: 2026-11-04 20:28

Title

Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring

Summary

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-284 - Improper Access Control

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48868 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Windows) , < 13.2.36231 (Windows) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)
TeamViewer	Host	Affected: 0 , < 15.83 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.10 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48868 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Windows) , < 13.2.36231 (Windows) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)
TeamViewer	Remote Management - Monitoring	Affected: 0 , < 26.10.1 (custom)

Credits

0x_alibabas (Giuliano Sanfins)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:46.571044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:13.182Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.10 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36231 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ITbrain_Monitoring_Service.exe",
            "MonitoringDaemon",
            "teamviewer-monitoringd"
          ],
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Remote Management - Monitoring",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "26.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0x_alibabas (Giuliano Sanfins)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn improper access control vulnerability in\nthe IPC communication between TeamViewer Full Client or Host prior to version\n15.83 and the Remote Management Monitoring component prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute scripts as\nSYSTEM/root.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "An improper access control vulnerability in\nthe IPC communication between TeamViewer Full Client or Host prior to version\n15.83 and the Remote Management Monitoring component prior to version 26.10.1\nallows a local authenticated attacker with low privileges to execute scripts as\nSYSTEM/root."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:10:09.611Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92375",
    "datePublished": "2026-10-27T15:10:09.611Z",
    "dateReserved": "2026-09-16T07:16:01.957Z",
    "dateUpdated": "2026-11-04T20:28:13.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92374 (GCVE-0-2026-92374)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:09 – Updated: 2026-11-04 20:28

Title

Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

Summary

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-367 - Time-of-check time-of-use (TOCTOU) race condition

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.154007 (custom)
TeamViewer	Host	Affected: 0 , < 15.83 (custom) Affected: 14.7.0 , < 14.7.48868 (custom) Affected: 13.2.0 , < 13.2.154007 (custom)

Credits

HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:44.775397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:19.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.\u202f\u0026nbsp;"
            }
          ],
          "value": "A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:09:25.189Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92374",
    "datePublished": "2026-10-27T15:09:25.189Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-11-04T20:28:19.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92372 (GCVE-0-2026-92372)

Vulnerability from cvelistv5 – Published: 2026-10-27 15:08 – Updated: 2026-11-04 20:28

Title

Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

Summary

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:45 UTC

CWE

CWE-123 - Write-what-where condition

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TeamViewer	Full Client	Affected: 0 , < 15.83 (custom) Affected: 14.7.0 (Linux) , < 14.7.48868 (Linux) (custom) Affected: 14.7.0 (macOS) , < 14.7.48868 (macOS) (custom) Affected: 13.2.0 (Linux) , < 13.2.154008 (Linux) (custom) Affected: 13.2.0 (macOS) , < 13.2.154007 (macOS) (custom)

Credits

HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:45:43.318702Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:28:25.133Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48868 (macOS)",
              "status": "affected",
              "version": "14.7.0 (macOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154008 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.154007 (macOS)",
              "status": "affected",
              "version": "13.2.0 (macOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HeaZzy (Mathys KHALFA) \u0026 skav (Antoine RIEUL)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn out-of-bounds write vulnerability in the\nscreen-image decoder of TeamViewer Full Client for Linux and macOS prior to\nversion 15.83 allows a remote attacker to execute arbitrary code by supplying\ncrafted screen-image data during a remote-control session. The vulnerability\ncan also be exploited by persuading a user to open a specially crafted\nTeamViewer session recording (.tvs). Missing destination bounds checking in the\ndecoder allows crafted screen-image data to cause an out-of-bounds write to the\nimage buffer. Exploitation requires user interaction.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "An out-of-bounds write vulnerability in the\nscreen-image decoder of TeamViewer Full Client for Linux and macOS prior to\nversion 15.83 allows a remote attacker to execute arbitrary code by supplying\ncrafted screen-image data during a remote-control session. The vulnerability\ncan also be exploited by persuading a user to open a specially crafted\nTeamViewer session recording (.tvs). Missing destination bounds checking in the\ndecoder allows crafted screen-image data to cause an out-of-bounds write to the\nimage buffer. Exploitation requires user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-123",
              "description": "CWE-123 Write-what-where condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T15:08:28.439Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest available version."
            }
          ],
          "value": "Update to the latest available version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92372",
    "datePublished": "2026-10-27T15:08:28.439Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-11-04T20:28:25.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92370 (GCVE-0-2026-92370)

Vulnerability from cvelistv5 – Published: 2026-09-29 15:42 – Updated: 2026-09-30 15:28

Title

Remote Session Access Control Bypass Leading to Remote Code Execution

Summary

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:12 UTC

CWE

CWE-284 - Improper Access Control

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)

Credits

We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:12:37.475626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:18.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.\u0026nbsp;"
            }
          ],
          "value": "An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim\u0027s configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-113",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-113 Interface Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:42:27.283Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Session Access Control Bypass Leading to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92370",
    "datePublished": "2026-09-29T15:42:27.283Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:18.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92371 (GCVE-0-2026-92371)

Vulnerability from cvelistv5 – Published: 2026-09-29 15:41 – Updated: 2026-09-30 15:28

Title

Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording

Summary

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:12 UTC

CWE

CWE-59 - Improper link resolution before file access ('link following')

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom)

Credits

We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:12:52.300273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:18.820Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.\u202f\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:41:12.493Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92371",
    "datePublished": "2026-09-29T15:41:12.493Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:18.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92368 (GCVE-0-2026-92368)

Vulnerability from cvelistv5 – Published: 2026-09-29 15:40 – Updated: 2026-09-30 15:28

Title

Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution

Summary

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:15 UTC

CWE

CWE-122 - Heap-based buffer overflow

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.70 , < 15.82 (custom)
TeamViewer	Host	Affected: 15.70 , < 15.82 (custom)

Credits

We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:15:23.642523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:18.950Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.70",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank HeaZzy (Mathys KHALFA) \u0026 skav\u202f(Antoine RIEUL) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the \"Play or convert recorded session\u2026\" feature, an attacker may achieve arbitrary code execution with the privileges of the current user"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:40:30.767Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92368",
    "datePublished": "2026-09-29T15:40:30.767Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:18.950Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92369 (GCVE-0-2026-92369)

Vulnerability from cvelistv5 – Published: 2026-09-29 15:39 – Updated: 2026-09-30 15:28

Title

Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation

Summary

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:15 UTC

CWE

CWE-367 - Time-of-check time-of-use (TOCTOU) race condition

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48855 (custom) Affected: 13.2.0 , < 13.2.36230 (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 , < 14.7.48855 (custom) Affected: 13.2.0 , < 13.2.36230 (custom)

Credits

We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:15:35.268669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:19.100Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855",
              "status": "affected",
              "version": "14.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.\u0026nbsp;\u0026nbsp;"
            }
          ],
          "value": "TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-29",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:53.082Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-92369",
    "datePublished": "2026-09-29T15:39:53.082Z",
    "dateReserved": "2026-09-16T07:16:01.956Z",
    "dateUpdated": "2026-09-30T15:28:19.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19743 (GCVE-0-2026-19743)

Vulnerability from cvelistv5 – Published: 2026-09-29 15:39 – Updated: 2026-09-30 15:28

Title

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients

Summary

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:20 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

TV CNA

CNA scorecard B 81/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://www.teamviewer.com/en/resources/trust-cen…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
TeamViewer	Full Client	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)
TeamViewer	Host	Affected: 15.0 , < 15.82 (custom) Affected: 15.64.0 (Legacy Windows 7 & 8) , < 15.64.8 (Legacy Windows 7 & 8) (custom) Affected: 14.7.0 (Windows) , < 14.7.48855 (Windows) (custom) Affected: 13.2.0 (Windows) , < 13.2.36230 (Windows) (custom) Affected: 14.7.0 (Linux) , < 14.7.48855 (Linux) (custom) Affected: 13.2.0 (Linux) , < 13.2.153995 (Linux) (custom) Affected: 14.7.0 (MacOS) , < 14.7.48855 (MacOS) (custom) Affected: 13.2.0 (MacOS) , < 13.2.153994 (MacOS) (custom)

Credits

We thank Timo De Clercq & 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19743",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:20:48.791393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:19.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Full Client",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "Host",
          "vendor": "TeamViewer",
          "versions": [
            {
              "lessThan": "15.82",
              "status": "affected",
              "version": "15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.64.8 (Legacy Windows 7 \u0026 8)",
              "status": "affected",
              "version": "15.64.0 (Legacy Windows 7 \u0026 8)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Windows)",
              "status": "affected",
              "version": "14.7.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.36230 (Windows)",
              "status": "affected",
              "version": "13.2.0 (Windows)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (Linux)",
              "status": "affected",
              "version": "14.7.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153995 (Linux)",
              "status": "affected",
              "version": "13.2.0 (Linux)",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.48855 (MacOS)",
              "status": "affected",
              "version": "14.7.0 (MacOS)",
              "versionType": "custom"
            },
            {
              "lessThan": "13.2.153994 (MacOS)",
              "status": "affected",
              "version": "13.2.0 (MacOS)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We thank Timo De Clercq \u0026 0x_alibabas (Giuliano Sanfins) for the discovery and responsible disclosure."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.\u202f\u0026nbsp;"
            }
          ],
          "value": "Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \\ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:39:11.503Z",
        "orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
        "shortName": "TV"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the latest version."
            }
          ],
          "value": "Update to the latest version."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6",
    "assignerShortName": "TV",
    "cveId": "CVE-2026-19743",
    "datePublished": "2026-09-29T15:39:11.503Z",
    "dateReserved": "2026-08-13T13:55:15.000Z",
    "dateUpdated": "2026-09-30T15:28:19.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

139 vulnerabilities by TeamViewer

CVE-2026-92377 (GCVE-0-2026-92377)

CVE-2026-92376 (GCVE-0-2026-92376)

CVE-2026-92375 (GCVE-0-2026-92375)

CVE-2026-92374 (GCVE-0-2026-92374)

CVE-2026-92372 (GCVE-0-2026-92372)

CVE-2026-111585 (GCVE-0-2026-111585)

CVE-2026-111584 (GCVE-0-2026-111584)

CVE-2026-111583 (GCVE-0-2026-111583)

CVE-2026-111582 (GCVE-0-2026-111582)

CVE-2026-92371 (GCVE-0-2026-92371)

CVE-2026-92370 (GCVE-0-2026-92370)

CVE-2026-92369 (GCVE-0-2026-92369)

CVE-2026-92368 (GCVE-0-2026-92368)

CVE-2026-19743 (GCVE-0-2026-19743)

CVE-2026-19042 (GCVE-0-2026-19042)

CVE-2026-16444 (GCVE-0-2026-16444)

CVE-2026-111585 (GCVE-0-2026-111585)

CVE-2026-111584 (GCVE-0-2026-111584)

CVE-2026-111583 (GCVE-0-2026-111583)

CVE-2026-111582 (GCVE-0-2026-111582)

CVE-2026-92377 (GCVE-0-2026-92377)

CVE-2026-92376 (GCVE-0-2026-92376)

CVE-2026-92375 (GCVE-0-2026-92375)

CVE-2026-92374 (GCVE-0-2026-92374)

CVE-2026-92372 (GCVE-0-2026-92372)

CVE-2026-92370 (GCVE-0-2026-92370)

CVE-2026-92371 (GCVE-0-2026-92371)

CVE-2026-92368 (GCVE-0-2026-92368)

CVE-2026-92369 (GCVE-0-2026-92369)

CVE-2026-19743 (GCVE-0-2026-19743)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

139 vulnerabilities by TeamViewer

CVE-2026-92377 (GCVE-0-2026-92377)

CVE-2026-92376 (GCVE-0-2026-92376)

CVE-2026-92375 (GCVE-0-2026-92375)

CVE-2026-92374 (GCVE-0-2026-92374)

CVE-2026-92372 (GCVE-0-2026-92372)

CVE-2026-111585 (GCVE-0-2026-111585)

CVE-2026-111584 (GCVE-0-2026-111584)

CVE-2026-111583 (GCVE-0-2026-111583)

CVE-2026-111582 (GCVE-0-2026-111582)

CVE-2026-92371 (GCVE-0-2026-92371)

CVE-2026-92370 (GCVE-0-2026-92370)

CVE-2026-92369 (GCVE-0-2026-92369)

CVE-2026-92368 (GCVE-0-2026-92368)

CVE-2026-19743 (GCVE-0-2026-19743)

CVE-2026-19042 (GCVE-0-2026-19042)

CVE-2026-16444 (GCVE-0-2026-16444)

CVE-2026-111585 (GCVE-0-2026-111585)

CVE-2026-111584 (GCVE-0-2026-111584)

CVE-2026-111583 (GCVE-0-2026-111583)

CVE-2026-111582 (GCVE-0-2026-111582)

CVE-2026-92377 (GCVE-0-2026-92377)

CVE-2026-92376 (GCVE-0-2026-92376)

CVE-2026-92375 (GCVE-0-2026-92375)

CVE-2026-92374 (GCVE-0-2026-92374)

CVE-2026-92372 (GCVE-0-2026-92372)

CVE-2026-92370 (GCVE-0-2026-92370)

CVE-2026-92371 (GCVE-0-2026-92371)

CVE-2026-92368 (GCVE-0-2026-92368)

CVE-2026-92369 (GCVE-0-2026-92369)

CVE-2026-19743 (GCVE-0-2026-19743)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.