TeamViewer urges users to patch severe flaws “as soon as possible”
TeamViewer urges immediate updates for five high-severity client and host flaws, including a remote code-execution bug.
72
Vulnerability3 · 1 read
CVE-2026-92369
TOCTOU privilege escalation in TeamViewer Windows installer
- CVSS 3.1
- 7.3 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
TeamViewer Full Client and Host before version 15.82 on Windows have a time-of-check time-of-use race (CWE-367) in the installer rollback path. A local low-privileged attacker can swap rollback backup files in a user-writable temporary directory before an elevated installer restores them, but only if the race is won during an installation or update that actually rolls back and a user is involved in that install. Successful exploitation yields NT AUTHORITY\SYSTEM, with high impact to confidentiality, integrity, and availability on the local host. Windows systems running those TeamViewer products below 15.82 are affected; other platforms and later builds are not described as vulnerable. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Update TeamViewer Full Client and Host on Windows to version 15.82 or later. Until then, restrict who can run or trigger installs and updates, and treat installer rollback as a privileged operation that low-privileged local users should not be able to influence.
| Product | Affected |
|---|---|
| TeamViewer Full Client | Windows versions prior to 15.82 |
| TeamViewer Host | Windows versions prior to 15.82 |
Estimated exposure
massmillions of Windows installations (exact count on versions before 15.82 unknown) — TeamViewer Full Client and Host are widely deployed remote-access software with a publicly reported global installed base well above one million Windows endpoints; the share still on builds before 15.82 is not published, so the figure is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
- Weakness
- CWE-367
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
In the news
3 storiesMultiple TeamViewer Vulnerabilities Enable RCE, Access Control Bypass and Privilege Escalation
TeamViewer patched five high-severity flaws enabling RCE, access-control bypass, and privilege escalation.
67
Critical TeamViewer Vulnerabilities Enable Code Execution Attacks Via Remote Session
TeamViewer patched five high-severity flaws, including an 8.8 access-control bypass that could enable code execution.
64