TeamViewer urges users to patch severe flaws “as soon as possible”
TeamViewer urges immediate updates for five high-severity client and host flaws, including a remote code-execution bug.
72
CVE-2026-19743
Path traversal LPE in TeamViewer Full Client and Host
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-19743 is an improper path validation flaw (CWE-22) in the local IPC service of TeamViewer Full Client and TeamViewer Host on Windows, Linux, and macOS before version 15.82. A local authenticated user with low privileges can send crafted IPC commands to the local service daemon and manipulate file paths. That leads to arbitrary file writes as NT AUTHORITY\SYSTEM on Windows or as root on Linux and macOS, which is a local privilege escalation (CVSS 3.1 7.8). Anyone running an unpatched Full Client or Host on those platforms is affected; remote, unauthenticated attack is not described. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade TeamViewer Full Client and TeamViewer Host to version 15.82 or later on Windows, Linux, and macOS. Until then, limit local logon to trusted accounts and watch the TeamViewer service for unexpected privileged file writes. No workaround is described in the advisory beyond patching.
| Product | Affected |
|---|---|
| TeamViewer Full Client | prior to 15.82 (Windows, Linux, and macOS) |
| TeamViewer Host | prior to 15.82 (Windows, Linux, and macOS) |
Estimated exposure
masstens of millions to 100M+ endpoints (order-of-magnitude; not all remain unpatched) — TeamViewer Full Client and Host are among the most widely deployed remote-access products; the vendor has publicly cited a global device footprint in the hundreds of millions over time, so installs still below 15.82 are plausibly at mass…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
3 storiesMultiple TeamViewer Vulnerabilities Enable RCE, Access Control Bypass and Privilege Escalation
TeamViewer patched five high-severity flaws enabling RCE, access-control bypass, and privilege escalation.
67
Critical TeamViewer Vulnerabilities Enable Code Execution Attacks Via Remote Session
TeamViewer patched five high-severity flaws, including an 8.8 access-control bypass that could enable code execution.
64