TeamViewer EUVD-2026-111075

Requires an attacker with an existing low-privileged, authenticated local account (PR:L) on a host running a vulnerable TeamViewer Full Client or Host (prior to 15.83) together with the Remote Management Monitoring component (prior to 26.10.1); the attacker abuses the IPC communication channel's improper access control to run scripts as SYSTEM/root. Limiting factors that reduce real-world risk: it is local-only (no remote/network path), it presumes the attacker already has a foothold and valid local credentials, and the vulnerable Remote Management Monitoring component must be deployed. No user interaction is needed (UI:N), and attack complexity is low (AC:L).

This is a local privilege-escalation flaw (CWE-284, improper access control) in TeamViewer's IPC channel between the Full Client/Host and the Remote Management Monitoring component, rated CVSS 7.8. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent with the description: it is local (AV:L), requires an already-authenticated low-privileged account (PR:L), needs no user interaction (UI:N), and yields full confidentiality, integrity, and availability impact because the attacker executes scripts as SYSTEM/root. The vuln.today decision label is 'this_week' and the vendor has published a patch, which signals real but not emergency urgency. No EPSS probability, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no signal of active exploitation or public exploit code - consistent with a local-only vector that is less attractive for mass automated attacks than a network-facing bug. The practical risk is: high impact on any host where an attacker already has a foothold (classic post-compromise SYSTEM escalation on a very widely installed product), but the AV:L requirement meaningfully caps real-world urgency versus a remote flaw. No key signals are directly conflicting; the main limitation is the absence of EPSS/KEV/PoC data to further grade likelihood.

An attacker who already holds a low-privileged local account on a machine running a vulnerable TeamViewer Full Client or Host (with the Remote Management Monitoring component installed) connects to the privileged IPC interface, which fails to properly enforce access control. By submitting crafted script requests over that IPC channel, the attacker has their payload executed in the SYSTEM/root context, achieving full local privilege escalation. No public exploit identified at time of analysis, and the local attack vector with low complexity (AV:L/AC:L) means a logged-in user can attempt it without user interaction.