EUVD-2026-89022
GHSA-j8jf-5637-q9wc
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L); AC:H because success requires winning a TOCTOU race; privileged file ops in arbitrary locations yield full C:H/I:H/A:H.
Primary rating from Vendor (TV).
CVSS VectorVendor: TV
Lifecycle Timeline
5DescriptionCVE.org
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in TeamViewer Full Client and Host for Linux versions before 15.82 allows an authenticated low-privileged attacker to exploit a race condition in the Cloud Session Recording (CSR) feature, potentially causing privileged file operations in unintended locations. The vulnerability requires the CSR feature to be active and carries a CVSS 3.1 score of 7.0 (High) due to high attack complexity (AC:H) and the need to win a TOCTOU race; no public exploit code has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the TeamViewer Cloud Session Recording (CSR) feature to be in use on a Linux host running Full Client or Host below version 15.82, plus local authenticated access as a low-privileged user (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 High) tells a consistent, self-limiting story: exploitation is LOCAL (AV:L), requires an already-authenticated low-privileged local user (PR:L), and carries HIGH attack complexity (AC:H) because success depends on winning a TOCTOU race condition between path validation and file access - a timing-dependent, non-deterministic step. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to TeamViewer Full Client or Host version 15.82 or later for Linux as provided by the vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, produce a complete inventory of Linux endpoints running TeamViewer Full Client or Host at any version below 15.82, identify which of those hosts have the Cloud Session Recording (CSR) feature enabled, and immediately disable CSR wherever it is not essential to a documented business process; simultaneously verify that local interactive access is limited to users who genuinely require it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Teamviewer
View allTeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. Rated high severity (CVSS
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] a
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. Rated medi
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by sk
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to exe
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthe
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authent
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. Rate
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82)
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today