TeamViewer Full Client CVE-2026-92377

Requires local authenticated access as a low-privileged user (PR:L, AV:L) on a Windows host running TeamViewer Full Client or Host below the fixed versions, with the Patch Management update mechanism present. The attacker must be able to forge an IPC response to that mechanism and write a malicious DLL into a user-writable temporary directory that the supplied signed executable then loads. No user interaction is needed (UI:N). Limiting factors: this is strictly local escalation - it cannot be triggered remotely or pre-authentication, and it does not affect non-Windows TeamViewer builds; an attacker must already possess a valid low-privilege foothold on the machine.

This is a genuine but second-tier priority: a local privilege-escalation flaw, not a remotely exploitable one. The supplied CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description - a local, authenticated, low-privileged user escalates to NT AUTHORITY\SYSTEM via a forged IPC response and DLL load from a user-writable directory. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no PoC or exploit reference appears in the input, so there is no evidence of active exploitation or public exploit code. The vendor's own priority label is 'this_week' (not act_now/emergency), which aligns with a patchable local EoP rather than an internet-facing emergency. Net: real and worth patching on a near-term cycle because the impact (SYSTEM) is maximal and AC:L means reliable exploitation once a foothold exists, but the AV:L requirement for pre-existing local authenticated access substantially limits real-world urgency compared to a network-exploitable bug. One nuance to verify: because a low-privileged user ends up executing as SYSTEM, some analysts would argue for a scope change (S:C); the input uses S:U, which is defensible if TeamViewer's service is treated as both vulnerable and impacted component.

An attacker who already has a low-privileged authenticated session on a Windows host running TeamViewer Full Client or Host sends a forged IPC response to the Patch Management update mechanism, causing it to accept an attacker-supplied signed executable. That executable loads a malicious DLL the attacker has planted in a user-writable temporary directory, and the code runs as NT AUTHORITY\SYSTEM. No public exploit identified at time of analysis, so this would require original exploit development.