TeamViewer Remote Management CVE-2026-111582

Exploitation requires a local, authenticated low-privileged account on the Windows host (PR:L) from which the attacker can write a malicious DLL into a directory searched by the TeamViewer Remote Management Monitoring installer (a DLL search-order/planting condition). A separate higher-privileged user must then execute the vulnerable installer version (prior to 26.10.1), which loads the planted DLL with elevated privileges (UI:R). Limiting factors: no remote vector (AV:L), the victim must actively run the installer, the attacker must already have a foothold on the machine, and only installer versions before 26.10.1 are affected - updating to 26.10.1 removes the condition. The precise search path the installer uses is not described in the available sources.

This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R) scores 7.3 (HIGH), but the attack is strictly LOCAL: an attacker already needs an authenticated low-privileged account on the host (PR:L) AND a higher-privileged user must be induced to run the installer (UI:R). These two constraints sharply reduce the realistic blast radius compared to the raw 7.3 - this cannot be exploited remotely or at scale. No EPSS score is present in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. The vendor's own priority signal (Decision label: this_week) is consistent with a patch-within-the-sprint cadence rather than act_now/emergency. Net: a credible local privilege-escalation issue worth remediating on a normal patch cycle, not a drop-everything event, with the caveat that EPSS data is missing and could not be factored in.

A low-privileged user (or malware running in that user's context) plants a malicious DLL in a directory that the TeamViewer Remote Management Monitoring installer searches when loading libraries. When an administrator or elevated user subsequently runs the vulnerable installer (prior to 26.10.1), the planted DLL is loaded and the attacker's code executes with the installer's elevated privileges, yielding full local compromise. No public exploit code has been identified at time of analysis, and the local access plus user-interaction requirements limit opportunistic use.