EUVD-2026-89020
GHSA-gc52-c427-xf67
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged foothold
-
DeliveryMonitor user-writable installer temp directory
-
ExploitTrigger or await install/update rollback
-
ExecutionWin race to replace rollback backup files
-
PersistElevated installer restores malicious files
-
ImpactPrivilege escalation to NT AUTHORITY\SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires an existing local, low-privileged account on the affected Windows host (PR:L, AV:L) plus a specific runtime event: the TeamViewer installer's rollback mechanism must execute during an installation or update, and rollback backup files must be staged in a user-writable temporary directory. The attacker must then win a TOCTOU race (CWE-367) to overwrite those backup files after the elevated installer validates them but before it restores them. Limiting factors: no remote exploitation possible; a rollback must actually occur during install/update (UI:R - an admin/installer action); success is probabilistic and depends on precise timing, so exploitation is not guaranteed on a single attempt. Fixed in TeamViewer Full Client and Host version 15.82. |
| Impact | This is a legitimate but conditional local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 7.3) confirms a local, low-privileged attacker gaining full C/I/A impact - consistent with escalation to NT AUTHORITY\SYSTEM. However, there is a notable internal tension: the vendor scored AC:L, yet the description explicitly states 'Exploitation requires successful timing of the race condition,' which is the textbook justification for AC:H in a CWE-367 TOCTOU flaw; this likely overstates the real-world reliability and slightly inflates the score. No EPSS score, KEV entry, POC, or SSVC data was provided, so exploitation is 'no public exploit identified at time of analysis' - this is not a drop-everything issue. The compound preconditions (local foothold + a rollback event occurring during an install/update + winning a timing race) make opportunistic mass exploitation impractical; this is a targeted, chained escalation primitive rather than a wormable or widely-exploited bug. Net: a real medium priority for hardened/multi-user Windows endpoints, not a high-urgency emergency. |
| Exploit ScenarioDerived | A low-privileged user already on a Windows host plants malicious content and monitors the user-writable temporary directory where TeamViewer's installer stages rollback backup files. When an elevated install or update triggers a rollback, the attacker wins a race to swap the trusted backup files for attacker-controlled ones just before the elevated installer restores them, causing SYSTEM-level execution or file overwrite. No public exploit code has been identified, and success depends on precisely timing the race during a real rollback event. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Local privilege escalation in TeamViewer Full Client and Host for Windows (versions prior to 15.82) lets an authenticated low-privileged local user escalate to NT AUTHORITY\SYSTEM by winning a time-of-check-to-time-of-use race against the elevated installer's rollback routine. The attacker must already hold a low-privileged account on the host and must wait for a specific runtime event - a rollback actually occurring during a TeamViewer installation or update - after which they overwrite rollback backup files staged in a user-writable temporary directory before the elevated installer restores them; the assessed attack complexity is High (CVSS:3.1/AV:L/AC:H/PR:L/UI:R), so success is probabilistic and depends on precise timing rather than being guaranteed on a single attempt. This is a legitimate but conditional local privilege escalation: it cannot be triggered remotely, it requires a local account plus an installer/update action (UI:R), and no public exploit code or confirmed active exploitation has been identified at time of analysis. The vendor-released fix is TeamViewer Full Client and Host 15.82.
RemediationAI
The primary fix is to upgrade TeamViewer Full Client and Host on Windows to version 15.82 or later (vendor-released patch: 15.82), which removes the TOCTOU window in the installer rollback logic; see the vendor advisory at https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/ for the official guidance and update packages, and verify the installed build after upgrading rather than relying on auto-update alone. Because exploitation requires an existing low-privileged local account plus an installer/update action, the most effective compensating control is to reduce the population of local accounts that can log on interactively to machines running TeamViewer (for example, remove unnecessary local users and restrict interactive/RDP logon rights) - the trade-off is tighter operational access for support staff. Where the update cannot be applied immediately, restrict who can initiate TeamViewer installs, updates, and repairs (limit elevated-installer execution to trusted administrators and block standard users from launching the installer), acknowledging that this inconveniences delegated deployment workflows. Monitor and audit installation/update events for unexpected rollbacks and for writes to installer temporary directories by non-administrative users, though such detection is inherently after-the-fact and noisy. Note that no vendor patch circumvention (such as disabling rollback) is documented, and disabling rollback itself is not a supported configuration; treat version 15.82 as the remediation baseline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a classic time-of-check-to-time-of-use (TOCTOU) flaw, classified as CWE-367, inside the TeamViewer Windows installer's rollback mechanism. Rollback/backup artifacts used to undo a failed or interrupted installation or update are staged in a temporary directory that is writable by a non-privileged local user, while the component that later validates and restores those files executes with elevated (installer/SYSTEM) privileges. Because validation and restoration are separate operations on a path the attacker can influence, a local attacker can swap the benign backup file for attacker-controlled content in the window between the check and the use. When the elevated installer subsequently restores that file, the attacker's payload is written with SYSTEM privileges, yielding full local privilege escalation (C:H/I:H/A:H, S:U in the assessed vector). The CPE data identifies the two affected code bases as cpe:2.3:a:teamviewer:full_client and cpe:2.3:a:teamviewer:host, i.e., the TeamViewer Full Client and the TeamViewer Host module on Windows. Note that the independent assessment raises attack complexity to High (AC:H) relative to the vendor CVSS 7.3 base vector, reflecting that the race must be won at exactly the right moment and that a rollback must genuinely occur; the confidentiality, integrity, and availability impacts remain High, and the vulnerability does not cross a trust boundary through scope change (S:U).
Know when Teamviewer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local low-priv attacker with full SYSTEM impact, but success hinges on winning a race window during a rollback event, so AC:H and UI:R rather than the vendor's AC:L.
Primary rating from Vendor (TV).
CVSS VectorVendor: TV
Lifecycle Timeline
2DescriptionCVE.org
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
Articles & Coverage 2
Executive ViewAI
TeamViewer Full Client and Host for Windows deployments below version 15.82 expose organizations to a high-severity local privilege escalation risk that could allow an existing authenticated low-privileged user to gain SYSTEM-level control during an installation or update rollback. Although exploitation requires local access, a specific runtime event, and high timing complexity, and no public exploit identified at time of analysis, a successful attack could undermine endpoint integrity and expand an attacker's foothold across managed systems. Leadership should prioritize identifying affected installations and applying interim controls while awaiting a vendor patch.
No vendor-released patch identified at time of analysis; interim mitigations include restricting TeamViewer installation/update and rollback operations to authorized administrators, preventing standard users from writing to TeamViewer rollback temp directories, enforcing least privilege, application allowlisting, monitoring for suspicious local file writes and privilege escalation, and disabling or uninstalling TeamViewer Full Client/Host where not required. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Teamviewer
View allTeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. Rated high severity (CVSS
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] a
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. Rated medi
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by sk
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to exe
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthe
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authent
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. Rate
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82)
Exploit-DB