TeamViewer Full Client CVE-2026-111583

Exploitation requires that TeamViewer Full Client or Host (prior to 15.82 for Windows, or prior to 15.64.10 on the legacy Windows 7/8 branch) be installed and that the Advanced Asset Management component be undergoing installation/service activation - the specific window in which the installer reads options from its staging directory. The attacker must be a local, authenticated user with low privileges and able to write a crafted installer options file into that staging directory, and the exploit depends on the installer/service-activation step running (CVSS UI:R), so it is not self-triggering by the attacker alone. Limiting factors: no remote or network path (AV:L), the attacker must already have a local account, and the vulnerable processing only occurs on Windows during the Advanced Asset Management installation flow rather than in all deployments.

This is a genuine but bounded local privilege-escalation issue rather than a remote-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) establishes that an attacker must already be a local, authenticated low-privilege user and that some user interaction is required - meaning this cannot be triggered remotely or by an anonymous attacker. The payoff, however, is maximal: full SYSTEM-level command execution (C:H/I:H/A:H), which is the defining characteristic of a CWE-269 improper-privilege-management flaw. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; these absences are informational, not confirmation that exploitation is hard. The vendor-assigned decision label is 'this_week' (vuln.today priority), which is consistent with a locally-exploitable SYSTEM escalation that is patched but not under active attack - treat it as a prompt-but-not-crisis remediation. The signals are mutually consistent: a local-only, interaction-dependent vector naturally aligns with the absence of KEV/EPSS activity, suggesting opportunistic or insider risk rather than mass exploitation. No contradictions between the CVSS vector and the description were found - both agree the access is local and authenticated.

A low-privileged but authenticated user on a Windows endpoint running TeamViewer Full Client or Host (prior to 15.82) plants a crafted installer options file in the installer staging directory that the Advanced Asset Management installer reads during service activation. When that installation/activation step runs, the attacker-controlled file is processed and their commands execute in the SYSTEM context, granting full control of the host. No public exploit code is identified in the available data.