Host
Monthly
Local privilege escalation in TeamViewer Full Client and Host on Windows allows an authenticated low-privileged user to execute arbitrary commands as SYSTEM by placing a crafted installer options file in the Advanced Asset Management installer staging directory, which is processed during service activation. All Full Client and Host builds prior to 15.82 are affected, along with the legacy Windows 7/8 branch prior to 15.64.10. A vendor patch is available, and no public exploit has been identified at time of analysis.
Local privilege escalation to NT AUTHORITY\SYSTEM affects TeamViewer Full Client and Host for Windows builds prior to 15.82 (including the 13.2.x and 14.7.x branches and the 15.64.x legacy Windows 7/8 line), where improper access control in the Patch Management update mechanism lets a low-privileged, locally authenticated user forge an IPC response so a vendor-signed executable loads a malicious DLL planted in a user-writable temporary directory. The CVSS vector (AV:L/PR:L/UI:N, C/I/H) confirms this is strictly a post-compromise escalation: the attacker must already hold a foothold on the Windows host, and remote or pre-authentication triggering is not possible. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released fixed builds, so priority is this_week rather than emergency. Non-Windows TeamViewer builds are not in scope.
Local privilege escalation in TeamViewer Full Client and Host (prior to 15.83) and the Remote Management - Monitoring component (prior to 26.10.1) allows an authenticated low-privileged local user to execute scripts as SYSTEM/root by abusing improper access control on the IPC channel between the client/host and the monitoring component. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful abuse gives full confidentiality, integrity and availability impact on the affected host, but requires the attacker to already hold a valid low-privileged local account and presumes the Remote Management - Monitoring component is deployed. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; vendor-released fixes exist (15.83 for current Full Client/Host branches, 15.64.10 for legacy Windows 7/8 builds, and 26.10.1 for Remote Management - Monitoring) per TeamViewer bulletin TV-2026-1012.
Local privilege escalation in TeamViewer Full Client and Host for macOS lets a low-privileged local attacker exploit a TOCTOU race combined with symbolic-link handling in the privileged helper to bypass installer package verification and install a malicious package as root. Affected builds are prior to 15.83, plus 14.7.x before 14.7.48868 and 13.2.x before 13.2.154007; exploitation is local-only and requires winning the timing window. No public exploit was identified in the supplied sources at time of analysis, and the vendor has released fixed versions.
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.
Local privilege escalation in TeamViewer Full Client and Host for Linux versions before 15.82 allows an authenticated low-privileged attacker to exploit a race condition in the Cloud Session Recording (CSR) feature, potentially causing privileged file operations in unintended locations. The vulnerability requires the CSR feature to be active and carries a CVSS 3.1 score of 7.0 (High) due to high attack complexity (AC:H) and the need to win a TOCTOU race; no public exploit code has been identified at time of analysis. Successful exploitation could lead to high confidentiality and integrity impact, including arbitrary file overwrite or information disclosure.
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.
Local privilege escalation in TeamViewer Full Client and Host for Windows (versions prior to 15.82) lets an authenticated low-privileged local user escalate to NT AUTHORITY\SYSTEM by winning a time-of-check-to-time-of-use race against the elevated installer's rollback routine. The attacker must already hold a low-privileged account on the host and must wait for a specific runtime event - a rollback actually occurring during a TeamViewer installation or update - after which they overwrite rollback backup files staged in a user-writable temporary directory before the elevated installer restores them; the assessed attack complexity is High (CVSS:3.1/AV:L/AC:H/PR:L/UI:R), so success is probabilistic and depends on precise timing rather than being guaranteed on a single attempt. This is a legitimate but conditional local privilege escalation: it cannot be triggered remotely, it requires a local account plus an installer/update action (UI:R), and no public exploit code or confirmed active exploitation has been identified at time of analysis. The vendor-released fix is TeamViewer Full Client and Host 15.82.
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82) allows an authenticated low-privileged local user to write arbitrary files with SYSTEM/root privileges by sending crafted IPC commands to the locally running privileged TeamViewer service daemon. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the flaw is deterministic rather than a race condition it is reliably triggerable once local access exists. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); however, the requirement of only low-privileged local access makes it a valuable post-compromise escalation primitive.
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to execute arbitrary OS commands as the current user by sending a crafted URL through the out-of-session chat feature. The attack exploits CWE-78 (OS Command Injection) in the Linux URL-handling path and requires only that the victim click the malicious link - no attacker authentication is needed. No public exploit has been identified at time of analysis; the vendor has released a patch in version 15.81.5 per advisory TV-2026-1009.
Local privilege escalation in TeamViewer Full Client and Host on Windows allows an authenticated low-privileged user to execute arbitrary commands as SYSTEM by placing a crafted installer options file in the Advanced Asset Management installer staging directory, which is processed during service activation. All Full Client and Host builds prior to 15.82 are affected, along with the legacy Windows 7/8 branch prior to 15.64.10. A vendor patch is available, and no public exploit has been identified at time of analysis.
Local privilege escalation to NT AUTHORITY\SYSTEM affects TeamViewer Full Client and Host for Windows builds prior to 15.82 (including the 13.2.x and 14.7.x branches and the 15.64.x legacy Windows 7/8 line), where improper access control in the Patch Management update mechanism lets a low-privileged, locally authenticated user forge an IPC response so a vendor-signed executable loads a malicious DLL planted in a user-writable temporary directory. The CVSS vector (AV:L/PR:L/UI:N, C/I/H) confirms this is strictly a post-compromise escalation: the attacker must already hold a foothold on the Windows host, and remote or pre-authentication triggering is not possible. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released fixed builds, so priority is this_week rather than emergency. Non-Windows TeamViewer builds are not in scope.
Local privilege escalation in TeamViewer Full Client and Host (prior to 15.83) and the Remote Management - Monitoring component (prior to 26.10.1) allows an authenticated low-privileged local user to execute scripts as SYSTEM/root by abusing improper access control on the IPC channel between the client/host and the monitoring component. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful abuse gives full confidentiality, integrity and availability impact on the affected host, but requires the attacker to already hold a valid low-privileged local account and presumes the Remote Management - Monitoring component is deployed. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; vendor-released fixes exist (15.83 for current Full Client/Host branches, 15.64.10 for legacy Windows 7/8 builds, and 26.10.1 for Remote Management - Monitoring) per TeamViewer bulletin TV-2026-1012.
Local privilege escalation in TeamViewer Full Client and Host for macOS lets a low-privileged local attacker exploit a TOCTOU race combined with symbolic-link handling in the privileged helper to bypass installer package verification and install a malicious package as root. Affected builds are prior to 15.83, plus 14.7.x before 14.7.48868 and 13.2.x before 13.2.154007; exploitation is local-only and requires winning the timing window. No public exploit was identified in the supplied sources at time of analysis, and the vendor has released fixed versions.
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.
Local privilege escalation in TeamViewer Full Client and Host for Linux versions before 15.82 allows an authenticated low-privileged attacker to exploit a race condition in the Cloud Session Recording (CSR) feature, potentially causing privileged file operations in unintended locations. The vulnerability requires the CSR feature to be active and carries a CVSS 3.1 score of 7.0 (High) due to high attack complexity (AC:H) and the need to win a TOCTOU race; no public exploit code has been identified at time of analysis. Successful exploitation could lead to high confidentiality and integrity impact, including arbitrary file overwrite or information disclosure.
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.
Local privilege escalation in TeamViewer Full Client and Host for Windows (versions prior to 15.82) lets an authenticated low-privileged local user escalate to NT AUTHORITY\SYSTEM by winning a time-of-check-to-time-of-use race against the elevated installer's rollback routine. The attacker must already hold a low-privileged account on the host and must wait for a specific runtime event - a rollback actually occurring during a TeamViewer installation or update - after which they overwrite rollback backup files staged in a user-writable temporary directory before the elevated installer restores them; the assessed attack complexity is High (CVSS:3.1/AV:L/AC:H/PR:L/UI:R), so success is probabilistic and depends on precise timing rather than being guaranteed on a single attempt. This is a legitimate but conditional local privilege escalation: it cannot be triggered remotely, it requires a local account plus an installer/update action (UI:R), and no public exploit code or confirmed active exploitation has been identified at time of analysis. The vendor-released fix is TeamViewer Full Client and Host 15.82.
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82) allows an authenticated low-privileged local user to write arbitrary files with SYSTEM/root privileges by sending crafted IPC commands to the locally running privileged TeamViewer service daemon. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the flaw is deterministic rather than a race condition it is reliably triggerable once local access exists. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); however, the requirement of only low-privileged local access makes it a valuable post-compromise escalation primitive.
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to execute arbitrary OS commands as the current user by sending a crafted URL through the out-of-session chat feature. The attack exploits CWE-78 (OS Command Injection) in the Linux URL-handling path and requires only that the victim click the malicious link - no attacker authentication is needed. No public exploit has been identified at time of analysis; the vendor has released a patch in version 15.81.5 per advisory TV-2026-1009.