TeamViewer Desktop CVE-2026-16444

Exploitation requires the attacker to be an active, accepted participant in an established TeamViewer remote session with the victim - the victim must have accepted or initiated the session, satisfying the UI:R requirement in the CVSS vector. The vulnerable mechanisms are specifically the file transfer feature and the virtual file clipboard, both of which are enabled by default in TeamViewer and are standard components of normal support workflows. Exploitation is bounded by the privilege level of the user account running TeamViewer on the victim system; it does not inherently grant administrative or SYSTEM-level access unless the victim is running TeamViewer elevated. Legacy Windows 7/8 users and all v13/v14 installations across Windows, Linux, and macOS are explicitly within scope per CPE data. The PR:N CVSS metric indicates no local system credentials are required; however, the attacker must obtain TeamViewer session access, which typically involves social engineering the victim or compromising a trusted TeamViewer account.

The CVSS 7.5 score reflects AC:H and UI:R constraints that limit opportunistic mass exploitation: the attacker must be an active participant in a TeamViewer session the victim has accepted. However, the social-engineering barrier for establishing a fraudulent 'support session' is well-documented and operationally modest, making the AC:H designation somewhat optimistic in realistic threat models. The high C/I/A triple indicates severe potential impact - arbitrary file write enables persistence (startup folder planting), privilege escalation via DLL hijacking in trusted directories, or direct code execution at the victim's privilege level. No EPSS score was provided in the input data; CISA KEV listing has not been confirmed, indicating no verified widespread active exploitation at time of analysis. A notable inconsistency exists: the CVSS vector carries PR:N while the description specifies 'authenticated remote session participant' - this likely reflects that TeamViewer session access, not local system credentials, is the prerequisite, but organizations should verify with the vendor whether session authentication constitutes a meaningful access barrier for their deployment model. No public exploit code has been identified.

An attacker poses as an IT support technician and convinces a victim to accept or initiate a TeamViewer remote session, then uses the file transfer or virtual clipboard feature to deliver a file whose name embeds a path traversal sequence - for example, a payload targeting the victim's Windows Startup folder path. TeamViewer writes the file to the traversed destination rather than the intended transfer directory, and the dropped payload executes with the victim's user privileges on the next login or clipboard interaction. No public exploit code has been identified at time of analysis, but the traversal mechanism is straightforward to reproduce once session access is established.