EUVD-2026-89019
GHSA-xx8p-86ff-fc5j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local IPC to a privileged daemon by an already-authenticated low-priv user (AV:L/PR:L), deterministic write so AC:L, arbitrary SYSTEM/root file write giving full C/I/A within one system (S:U).
Primary rating from Vendor (TV).
CVSS VectorVendor: TV
Lifecycle Timeline
6DescriptionCVE.org
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82) allows an authenticated low-privileged local user to write arbitrary files with SYSTEM/root privileges by sending crafted IPC commands to the locally running privileged TeamViewer service daemon. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the flaw is deterministic rather than a race condition it is reliably triggerable once local access exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing local, authenticated low-privileged session on a host running TeamViewer Full Client or Host prior to version 15.82, on Windows, Linux, or macOS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local privilege escalation flaw (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8, which I concur with). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update TeamViewer Full Client and TeamViewer Host to version 15.82 or later on all Windows, Linux, and macOS endpoints; this is the vendor-released patch and the only complete fix, with details in advisory TV-2026-1010 (https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every endpoint running TeamViewer Full Client or Host across Windows, Linux, and macOS, record the exact installed version, and flag all hosts at a release below 15.82 as exposed; confirm whether the TeamViewer service daemon is running with SYSTEM/root privileges and disable the service on machines that do not require remote support, and confirm there is no vendor-released patch identified at time of analysis, meaning no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status changes the urgency profile. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Teamviewer
View allTeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. Rated high severity (CVSS
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] a
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. Rated medi
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by sk
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to exe
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthe
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authent
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. Rate
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary
Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and mac
Same weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today