Teamviewer
Monthly
Integer overflow in TeamViewer's remote-control screen processing component affects Full Client, Portable, and Remote Control App versions before 15.83, allowing a malicious or already compromised remote host to crash the viewer and, on some platforms, potentially execute code with the viewer process's privileges. The victim must deliberately establish an outbound remote-control session as the viewer (UI:R), so the attack model is targeted or social-engineering oriented rather than unsolicited remote compromise. No public exploit code has been identified at time of analysis, and vendor patches are available.
Local privilege escalation in TeamViewer Remote Management Patch Management for Windows allows an authenticated low-privileged user to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation. The flaw affects versions prior to 26.9.1 and the legacy v14.7 client branch prior to 24.12.5. Exploitation requires a local foothold and an activation event, and no CISA KEV entry or public exploit code is referenced in the supplied intelligence.
Local privilege escalation in TeamViewer Full Client and Host on Windows allows an authenticated low-privileged user to execute arbitrary commands as SYSTEM by placing a crafted installer options file in the Advanced Asset Management installer staging directory, which is processed during service activation. All Full Client and Host builds prior to 15.82 are affected, along with the legacy Windows 7/8 branch prior to 15.64.10. A vendor patch is available, and no public exploit has been identified at time of analysis.
DLL search-order/planting in the TeamViewer Remote Management Monitoring installer for Windows before 26.10.1 lets a local authenticated low-privileged user plant a malicious DLL that is loaded with elevated privileges when a higher-privileged user runs the installer, yielding arbitrary code execution. Exploitation requires an existing foothold on the host plus user interaction, and no public exploit is identified at time of analysis. Vendor patch 26.10.1 resolves the condition; the assessed priority is this_week, a genuine but not emergency-grade issue.
Local privilege escalation to NT AUTHORITY\SYSTEM affects TeamViewer Full Client and Host for Windows builds prior to 15.82 (including the 13.2.x and 14.7.x branches and the 15.64.x legacy Windows 7/8 line), where improper access control in the Patch Management update mechanism lets a low-privileged, locally authenticated user forge an IPC response so a vendor-signed executable loads a malicious DLL planted in a user-writable temporary directory. The CVSS vector (AV:L/PR:L/UI:N, C/I/H) confirms this is strictly a post-compromise escalation: the attacker must already hold a foothold on the Windows host, and remote or pre-authentication triggering is not possible. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released fixed builds, so priority is this_week rather than emergency. Non-Windows TeamViewer builds are not in scope.
Local privilege escalation in TeamViewer Remote Management Monitoring for Windows before 26.10.1: a low-privileged authenticated local user can impersonate the IPC broker and cause the Monitoring service to execute arbitrary code as NT AUTHORITY\SYSTEM. Only hosts with the Remote Management Monitoring component installed and its service running are affected (base TeamViewer remote-access installs without the Monitoring module are not indicated as affected by available data), and exploitation requires an existing low-privilege local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). This is a credible but non-emergency issue - no public exploit code or active exploitation is confirmed, and the vendor has released a fixed version (26.10.1).
Local privilege escalation in TeamViewer Full Client and Host (prior to 15.83) and the Remote Management - Monitoring component (prior to 26.10.1) allows an authenticated low-privileged local user to execute scripts as SYSTEM/root by abusing improper access control on the IPC channel between the client/host and the monitoring component. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful abuse gives full confidentiality, integrity and availability impact on the affected host, but requires the attacker to already hold a valid low-privileged local account and presumes the Remote Management - Monitoring component is deployed. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; vendor-released fixes exist (15.83 for current Full Client/Host branches, 15.64.10 for legacy Windows 7/8 builds, and 26.10.1 for Remote Management - Monitoring) per TeamViewer bulletin TV-2026-1012.
Local privilege escalation in TeamViewer Full Client and Host for macOS lets a low-privileged local attacker exploit a TOCTOU race combined with symbolic-link handling in the privileged helper to bypass installer package verification and install a malicious package as root. Affected builds are prior to 15.83, plus 14.7.x before 14.7.48868 and 13.2.x before 13.2.154007; exploitation is local-only and requires winning the timing window. No public exploit was identified in the supplied sources at time of analysis, and the vendor has released fixed versions.
An out-of-bounds write in the screen-image decoder of TeamViewer Full Client for Linux and macOS allows a remote attacker to execute arbitrary code on the victim's machine when the victim takes a user-driven action. Every build below 15.83 is affected, including the older branches prior to 13.2.154007 (macOS) / 13.2.154008 (Linux) and prior to 14.7.48868; the two described paths are opening a crafted .tvs session recording supplied by the attacker or participating in a remote-control session into which crafted screen-image data is injected, which is why the assessed vector carries UI:R with PR:N at CVSS 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the issue is prioritized for remediation this week given the code-execution impact on unpatched endpoints.
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.
Local privilege escalation in TeamViewer Full Client and Host for Linux versions before 15.82 allows an authenticated low-privileged attacker to exploit a race condition in the Cloud Session Recording (CSR) feature, potentially causing privileged file operations in unintended locations. The vulnerability requires the CSR feature to be active and carries a CVSS 3.1 score of 7.0 (High) due to high attack complexity (AC:H) and the need to win a TOCTOU race; no public exploit code has been identified at time of analysis. Successful exploitation could lead to high confidentiality and integrity impact, including arbitrary file overwrite or information disclosure.
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.
Local privilege escalation in TeamViewer Full Client and Host for Windows (versions prior to 15.82) lets an authenticated low-privileged local user escalate to NT AUTHORITY\SYSTEM by winning a time-of-check-to-time-of-use race against the elevated installer's rollback routine. The attacker must already hold a low-privileged account on the host and must wait for a specific runtime event - a rollback actually occurring during a TeamViewer installation or update - after which they overwrite rollback backup files staged in a user-writable temporary directory before the elevated installer restores them; the assessed attack complexity is High (CVSS:3.1/AV:L/AC:H/PR:L/UI:R), so success is probabilistic and depends on precise timing rather than being guaranteed on a single attempt. This is a legitimate but conditional local privilege escalation: it cannot be triggered remotely, it requires a local account plus an installer/update action (UI:R), and no public exploit code or confirmed active exploitation has been identified at time of analysis. The vendor-released fix is TeamViewer Full Client and Host 15.82.
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82) allows an authenticated low-privileged local user to write arbitrary files with SYSTEM/root privileges by sending crafted IPC commands to the locally running privileged TeamViewer service daemon. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the flaw is deterministic rather than a race condition it is reliably triggerable once local access exists. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); however, the requirement of only low-privileged local access makes it a valuable post-compromise escalation primitive.
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to execute arbitrary OS commands as the current user by sending a crafted URL through the out-of-session chat feature. The attack exploits CWE-78 (OS Command Injection) in the Linux URL-handling path and requires only that the victim click the malicious link - no attacker authentication is needed. No public exploit has been identified at time of analysis; the vendor has released a patch in version 15.81.5 per advisory TV-2026-1009.
Path traversal in TeamViewer Desktop Clients prior to version 15.81.5 allows an authenticated remote session participant to write files to arbitrary locations on the victim's local filesystem via the file transfer and virtual file clipboard features. The affected product family spans Full Client, Host, QuickSupport, and Portable editions across Windows, Linux, and macOS, covering the v13, v14, and current v15 release lines. Arbitrary file write can be chained to code execution at the privilege level of the user running TeamViewer; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Broken access control in TeamViewer DEX Platform (On-Premises) before version 9.2 allows authenticated low-privileged users to invoke administrative API endpoints and access sensitive resources outside their authorized scope. The root cause is CWE-862 (Missing Authorization) - backend API endpoints omit proper role-based authorization checks despite confirming user identity. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the network-accessible attack vector and low complexity make exploitation straightforward for any user holding valid platform credentials.
TeamViewer DEX versions below 24.5 allow authenticated users with actioner privileges to execute arbitrary elevated commands on connected hosts through inadequate input validation in the 1E-Nomad-RunPkgStatusRequest instruction. An attacker with these credentials could inject malicious commands to gain unauthorized system access and control. The vulnerability requires user interaction and high-level privileges but carries a significant risk due to the potential for complete system compromise.
Log timestamp tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject malicious UDP Sync commands that corrupt event timestamps, undermining log integrity and forensic investigation capabilities. This input validation flaw affects Windows deployments of the NomadBranch service and could enable attackers to obscure the timeline of malicious activities or create misleading audit trails. No patch is currently available for this medium-severity vulnerability.
TeamViewer DEX Client versions before 26.1 contain an out-of-bounds read in the Content Distribution Service that enables remote attackers to leak stack memory and trigger denial of service without authentication. Successful exploitation could disclose memory contents useful for bypassing address space layout randomization and chaining with other vulnerabilities. No patch is currently available for this medium-severity flaw affecting Windows deployments.
Information disclosure and denial-of-service in TeamViewer DEX Client versions before 26.1 allows adjacent network attackers to trigger an out-of-bounds read via specially crafted packets, potentially leaking sensitive memory that could be leveraged to bypass ASLR protections. Affected Windows systems running the NomadBranch.exe content distribution service are vulnerable to attacks requiring only network proximity, with no authentication or user interaction needed.
Denial-of-service in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to crash the NomadBranch.exe service by sending specially crafted UDP packets that trigger a heap buffer overflow. The vulnerability stems from an integer underflow in the UDP command handler that can be exploited without authentication or user interaction. Currently, no patch is available and the attack requires network adjacency to the affected system.
Log tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject, modify, or forge entries in the NomadBranch.log file through the UDP network handler, compromising log integrity and audit trail reliability. An attacker with network access can send crafted packets to the Content Distribution Service to manipulate logging records without authentication, potentially obscuring malicious activity or creating false audit entries.
TeamViewer DEX Client versions prior to 26.1 contain a null pointer dereference in the NomadBranch.exe Content Distribution Service that allows adjacent network attackers to crash the process without authentication. An attacker can exploit this vulnerability to disable the Content Distribution Service, causing a denial-of-service condition on affected Windows systems. No patch is currently available.
Digital Employee Experience is affected by cleartext transmission of sensitive information (CVSS 6.5).
Digital Employee Experience versions up to 26.1 is affected by improper link resolution before file access (CVSS 5.7).
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated attacker with the Actioner privilege to execute arbitrary elevated commands on managed devices via the 1E-ConfigMgrConsoleExtensions instructions feature. The vulnerability arises from improper input validation (CWE-20) and carries a CVSS 3.1 score of 7.2 with a changed scope per independent assessment, but the high-privilege requirement (PR:H) makes it a conditional risk rather than an urgent mass-exploitation threat. EPSS is low at 0.87% (58th percentile), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V25 allows an authenticated user holding 'Actioner' privileges to inject arbitrary commands through the 1E-Nomad-PauseNomadJobQueue instruction, resulting in remote execution of elevated commands on devices connected to the platform. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the assessed vector raises scope to Changed (S:C); the dominant mitigating factor is the high-privilege Actioner role required, meaning this is not exploitable by an unauthenticated attacker and realistic risk comes from a malicious privileged insider or a compromised/stolen Actioner credential. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.87% (58th percentile), consistent with a moderate-priority issue whose severity is tempered by a meaningful access barrier.
Command injection in TeamViewer DEX (formerly 1E DEX) lets an authenticated user with Actioner privileges run arbitrary elevated commands on managed devices by submitting crafted input to the 1E-PatchInsights-Deploy instruction prior to V15. The issue is rooted in improper input validation (CWE-20) and carries a CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation is privilege-gated. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV absent); EPSS is 0.87% (58th percentile).
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V21.1 allows an authenticated attacker with Actioner privileges to execute arbitrary elevated commands on managed devices via the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction. The flaw is due to improper input validation (CWE-20), and exploitation requires high privileges (PR:H) but no user interaction. No public exploit code has been identified, and the EPSS score is 1.10% (65th percentile); our independent assessment rates this as a moderate-priority issue, consistent with the need for an elevated management role and connected devices to target.
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated user holding the elevated 'Actioner' privilege to execute arbitrary, elevated commands on endpoints managed by the platform, via the 1E-Nomad-GetCmContentLocations instruction in versions prior to V19.2. The flaw is an improper input validation issue (CWE-20) reachable over the network with no user interaction, but it is gated behind a high-privilege role (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires insider access or compromise of an Actioner account rather than anonymous access. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); EPSS is 1.16% (66th percentile), a moderate score consistent with a real but credential-gated threat. Vendor-released patch: V19.2.
Command injection in the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction of TeamViewer DEX (formerly 1E DEX) allows an authenticated operator holding the Actioner role to execute arbitrary elevated commands on devices managed through the platform. Because the required role is a privileged application role, realistic risk is bounded to malicious insiders or adversaries who already hold a high-privilege operator foothold; no public exploit code and no CISA KEV activity were identified at time of analysis, and the EPSS score of 1.16% (66th percentile) indicates low observed exploitation likelihood. Patch guidance is published in TeamViewer security bulletin TV-2025-1006.
Information disclosure in TeamViewer DEX Client (formerly 1E Client) prior to version 25.11 for Windows lets an attacker positioned on the same adjacent network segment coerce the NomadBranch.exe Content Distribution Service into sending data to an arbitrary internal IP address. No authentication or user interaction is required once network adjacency is achieved, and the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality with no integrity or availability effect, giving a base score of 6.5. Exploitation is not confirmed as active (no CISA KEV listing), no public exploit code has been identified at time of analysis, and EPSS is a low 0.20% (9th percentile); the operative barriers are the mandatory adjacent-network foothold, the presence of the vulnerable function on a pre-25.11 build, and exposure of the content-distribution service.
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthenticated attackers on an adjacent network to bypass file integrity validation by supplying a valid hash for a malicious file. The Content Distribution Service (NomadBranch.exe) then incorrectly trusts and processes the file, executing code in the service context. No public exploit code has been identified, and the EPSS score is low (0.30%), but the CVSS base score of 8.8 reflects high impact to confidentiality, integrity, and availability. This is a moderately high-priority vulnerability but not an emergency.
Denial of service in TeamViewer DEX Client (formerly 1E Client) for Windows prior to version 25.11 lets an unauthenticated attacker who is already on the same adjacent network segment crash the Content Distribution Service (NomadBranch.exe) with a crafted command, terminating the service process. Impact is limited to availability (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity effect and the service can be restarted on the host - so exploitation is only possible laterally from the local network and not from the internet, and hosts on 25.11 or later are unaffected. There is no public exploit identified at time of analysis and no KEV listing; EPSS is low at 0.21% (11th percentile), consistent with a moderate, availability-only issue of limited real-world urgency.
Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can lead to unintentional sharing of the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to elevate privileges by changing the personal. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in TeamViewer 14.2.2558. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes it easier to determine the correct value. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] and "[00 00 00]" delimiters, which might make it easier for attackers to obtain. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Integer overflow in TeamViewer's remote-control screen processing component affects Full Client, Portable, and Remote Control App versions before 15.83, allowing a malicious or already compromised remote host to crash the viewer and, on some platforms, potentially execute code with the viewer process's privileges. The victim must deliberately establish an outbound remote-control session as the viewer (UI:R), so the attack model is targeted or social-engineering oriented rather than unsolicited remote compromise. No public exploit code has been identified at time of analysis, and vendor patches are available.
Local privilege escalation in TeamViewer Remote Management Patch Management for Windows allows an authenticated low-privileged user to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation. The flaw affects versions prior to 26.9.1 and the legacy v14.7 client branch prior to 24.12.5. Exploitation requires a local foothold and an activation event, and no CISA KEV entry or public exploit code is referenced in the supplied intelligence.
Local privilege escalation in TeamViewer Full Client and Host on Windows allows an authenticated low-privileged user to execute arbitrary commands as SYSTEM by placing a crafted installer options file in the Advanced Asset Management installer staging directory, which is processed during service activation. All Full Client and Host builds prior to 15.82 are affected, along with the legacy Windows 7/8 branch prior to 15.64.10. A vendor patch is available, and no public exploit has been identified at time of analysis.
DLL search-order/planting in the TeamViewer Remote Management Monitoring installer for Windows before 26.10.1 lets a local authenticated low-privileged user plant a malicious DLL that is loaded with elevated privileges when a higher-privileged user runs the installer, yielding arbitrary code execution. Exploitation requires an existing foothold on the host plus user interaction, and no public exploit is identified at time of analysis. Vendor patch 26.10.1 resolves the condition; the assessed priority is this_week, a genuine but not emergency-grade issue.
Local privilege escalation to NT AUTHORITY\SYSTEM affects TeamViewer Full Client and Host for Windows builds prior to 15.82 (including the 13.2.x and 14.7.x branches and the 15.64.x legacy Windows 7/8 line), where improper access control in the Patch Management update mechanism lets a low-privileged, locally authenticated user forge an IPC response so a vendor-signed executable loads a malicious DLL planted in a user-writable temporary directory. The CVSS vector (AV:L/PR:L/UI:N, C/I/H) confirms this is strictly a post-compromise escalation: the attacker must already hold a foothold on the Windows host, and remote or pre-authentication triggering is not possible. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released fixed builds, so priority is this_week rather than emergency. Non-Windows TeamViewer builds are not in scope.
Local privilege escalation in TeamViewer Remote Management Monitoring for Windows before 26.10.1: a low-privileged authenticated local user can impersonate the IPC broker and cause the Monitoring service to execute arbitrary code as NT AUTHORITY\SYSTEM. Only hosts with the Remote Management Monitoring component installed and its service running are affected (base TeamViewer remote-access installs without the Monitoring module are not indicated as affected by available data), and exploitation requires an existing low-privilege local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). This is a credible but non-emergency issue - no public exploit code or active exploitation is confirmed, and the vendor has released a fixed version (26.10.1).
Local privilege escalation in TeamViewer Full Client and Host (prior to 15.83) and the Remote Management - Monitoring component (prior to 26.10.1) allows an authenticated low-privileged local user to execute scripts as SYSTEM/root by abusing improper access control on the IPC channel between the client/host and the monitoring component. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful abuse gives full confidentiality, integrity and availability impact on the affected host, but requires the attacker to already hold a valid low-privileged local account and presumes the Remote Management - Monitoring component is deployed. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; vendor-released fixes exist (15.83 for current Full Client/Host branches, 15.64.10 for legacy Windows 7/8 builds, and 26.10.1 for Remote Management - Monitoring) per TeamViewer bulletin TV-2026-1012.
Local privilege escalation in TeamViewer Full Client and Host for macOS lets a low-privileged local attacker exploit a TOCTOU race combined with symbolic-link handling in the privileged helper to bypass installer package verification and install a malicious package as root. Affected builds are prior to 15.83, plus 14.7.x before 14.7.48868 and 13.2.x before 13.2.154007; exploitation is local-only and requires winning the timing window. No public exploit was identified in the supplied sources at time of analysis, and the vendor has released fixed versions.
An out-of-bounds write in the screen-image decoder of TeamViewer Full Client for Linux and macOS allows a remote attacker to execute arbitrary code on the victim's machine when the victim takes a user-driven action. Every build below 15.83 is affected, including the older branches prior to 13.2.154007 (macOS) / 13.2.154008 (Linux) and prior to 14.7.48868; the two described paths are opening a crafted .tvs session recording supplied by the attacker or participating in a remote-control session into which crafted screen-image data is injected, which is why the assessed vector carries UI:R with PR:N at CVSS 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the issue is prioritized for remediation this week given the code-execution impact on unpatched endpoints.
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authenticated session participants to bypass user-configured permission settings during session establishment, potentially leading to unauthorized actions or remote code execution. The vulnerability requires the attacker to be a session participant (PR:L) and the victim to accept the session (UI:R), and no public exploit code is identified at time of analysis. This is a moderately high-priority issue but not an emergency.
Local privilege escalation in TeamViewer Full Client and Host for Linux versions before 15.82 allows an authenticated low-privileged attacker to exploit a race condition in the Cloud Session Recording (CSR) feature, potentially causing privileged file operations in unintended locations. The vulnerability requires the CSR feature to be active and carries a CVSS 3.1 score of 7.0 (High) due to high attack complexity (AC:H) and the need to win a TOCTOU race; no public exploit code has been identified at time of analysis. Successful exploitation could lead to high confidentiality and integrity impact, including arbitrary file overwrite or information disclosure.
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.
Local privilege escalation in TeamViewer Full Client and Host for Windows (versions prior to 15.82) lets an authenticated low-privileged local user escalate to NT AUTHORITY\SYSTEM by winning a time-of-check-to-time-of-use race against the elevated installer's rollback routine. The attacker must already hold a low-privileged account on the host and must wait for a specific runtime event - a rollback actually occurring during a TeamViewer installation or update - after which they overwrite rollback backup files staged in a user-writable temporary directory before the elevated installer restores them; the assessed attack complexity is High (CVSS:3.1/AV:L/AC:H/PR:L/UI:R), so success is probabilistic and depends on precise timing rather than being guaranteed on a single attempt. This is a legitimate but conditional local privilege escalation: it cannot be triggered remotely, it requires a local account plus an installer/update action (UI:R), and no public exploit code or confirmed active exploitation has been identified at time of analysis. The vendor-released fix is TeamViewer Full Client and Host 15.82.
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82) allows an authenticated low-privileged local user to write arbitrary files with SYSTEM/root privileges by sending crafted IPC commands to the locally running privileged TeamViewer service daemon. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the flaw is deterministic rather than a race condition it is reliably triggerable once local access exists. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); however, the requirement of only low-privileged local access makes it a valuable post-compromise escalation primitive.
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to execute arbitrary OS commands as the current user by sending a crafted URL through the out-of-session chat feature. The attack exploits CWE-78 (OS Command Injection) in the Linux URL-handling path and requires only that the victim click the malicious link - no attacker authentication is needed. No public exploit has been identified at time of analysis; the vendor has released a patch in version 15.81.5 per advisory TV-2026-1009.
Path traversal in TeamViewer Desktop Clients prior to version 15.81.5 allows an authenticated remote session participant to write files to arbitrary locations on the victim's local filesystem via the file transfer and virtual file clipboard features. The affected product family spans Full Client, Host, QuickSupport, and Portable editions across Windows, Linux, and macOS, covering the v13, v14, and current v15 release lines. Arbitrary file write can be chained to code execution at the privilege level of the user running TeamViewer; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Broken access control in TeamViewer DEX Platform (On-Premises) before version 9.2 allows authenticated low-privileged users to invoke administrative API endpoints and access sensitive resources outside their authorized scope. The root cause is CWE-862 (Missing Authorization) - backend API endpoints omit proper role-based authorization checks despite confirming user identity. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the network-accessible attack vector and low complexity make exploitation straightforward for any user holding valid platform credentials.
TeamViewer DEX versions below 24.5 allow authenticated users with actioner privileges to execute arbitrary elevated commands on connected hosts through inadequate input validation in the 1E-Nomad-RunPkgStatusRequest instruction. An attacker with these credentials could inject malicious commands to gain unauthorized system access and control. The vulnerability requires user interaction and high-level privileges but carries a significant risk due to the potential for complete system compromise.
Log timestamp tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject malicious UDP Sync commands that corrupt event timestamps, undermining log integrity and forensic investigation capabilities. This input validation flaw affects Windows deployments of the NomadBranch service and could enable attackers to obscure the timeline of malicious activities or create misleading audit trails. No patch is currently available for this medium-severity vulnerability.
TeamViewer DEX Client versions before 26.1 contain an out-of-bounds read in the Content Distribution Service that enables remote attackers to leak stack memory and trigger denial of service without authentication. Successful exploitation could disclose memory contents useful for bypassing address space layout randomization and chaining with other vulnerabilities. No patch is currently available for this medium-severity flaw affecting Windows deployments.
Information disclosure and denial-of-service in TeamViewer DEX Client versions before 26.1 allows adjacent network attackers to trigger an out-of-bounds read via specially crafted packets, potentially leaking sensitive memory that could be leveraged to bypass ASLR protections. Affected Windows systems running the NomadBranch.exe content distribution service are vulnerable to attacks requiring only network proximity, with no authentication or user interaction needed.
Denial-of-service in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to crash the NomadBranch.exe service by sending specially crafted UDP packets that trigger a heap buffer overflow. The vulnerability stems from an integer underflow in the UDP command handler that can be exploited without authentication or user interaction. Currently, no patch is available and the attack requires network adjacency to the affected system.
Log tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject, modify, or forge entries in the NomadBranch.log file through the UDP network handler, compromising log integrity and audit trail reliability. An attacker with network access can send crafted packets to the Content Distribution Service to manipulate logging records without authentication, potentially obscuring malicious activity or creating false audit entries.
TeamViewer DEX Client versions prior to 26.1 contain a null pointer dereference in the NomadBranch.exe Content Distribution Service that allows adjacent network attackers to crash the process without authentication. An attacker can exploit this vulnerability to disable the Content Distribution Service, causing a denial-of-service condition on affected Windows systems. No patch is currently available.
Digital Employee Experience is affected by cleartext transmission of sensitive information (CVSS 6.5).
Digital Employee Experience versions up to 26.1 is affected by improper link resolution before file access (CVSS 5.7).
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated attacker with the Actioner privilege to execute arbitrary elevated commands on managed devices via the 1E-ConfigMgrConsoleExtensions instructions feature. The vulnerability arises from improper input validation (CWE-20) and carries a CVSS 3.1 score of 7.2 with a changed scope per independent assessment, but the high-privilege requirement (PR:H) makes it a conditional risk rather than an urgent mass-exploitation threat. EPSS is low at 0.87% (58th percentile), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V25 allows an authenticated user holding 'Actioner' privileges to inject arbitrary commands through the 1E-Nomad-PauseNomadJobQueue instruction, resulting in remote execution of elevated commands on devices connected to the platform. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the assessed vector raises scope to Changed (S:C); the dominant mitigating factor is the high-privilege Actioner role required, meaning this is not exploitable by an unauthenticated attacker and realistic risk comes from a malicious privileged insider or a compromised/stolen Actioner credential. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.87% (58th percentile), consistent with a moderate-priority issue whose severity is tempered by a meaningful access barrier.
Command injection in TeamViewer DEX (formerly 1E DEX) lets an authenticated user with Actioner privileges run arbitrary elevated commands on managed devices by submitting crafted input to the 1E-PatchInsights-Deploy instruction prior to V15. The issue is rooted in improper input validation (CWE-20) and carries a CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation is privilege-gated. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV absent); EPSS is 0.87% (58th percentile).
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V21.1 allows an authenticated attacker with Actioner privileges to execute arbitrary elevated commands on managed devices via the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction. The flaw is due to improper input validation (CWE-20), and exploitation requires high privileges (PR:H) but no user interaction. No public exploit code has been identified, and the EPSS score is 1.10% (65th percentile); our independent assessment rates this as a moderate-priority issue, consistent with the need for an elevated management role and connected devices to target.
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated user holding the elevated 'Actioner' privilege to execute arbitrary, elevated commands on endpoints managed by the platform, via the 1E-Nomad-GetCmContentLocations instruction in versions prior to V19.2. The flaw is an improper input validation issue (CWE-20) reachable over the network with no user interaction, but it is gated behind a high-privilege role (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires insider access or compromise of an Actioner account rather than anonymous access. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); EPSS is 1.16% (66th percentile), a moderate score consistent with a real but credential-gated threat. Vendor-released patch: V19.2.
Command injection in the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction of TeamViewer DEX (formerly 1E DEX) allows an authenticated operator holding the Actioner role to execute arbitrary elevated commands on devices managed through the platform. Because the required role is a privileged application role, realistic risk is bounded to malicious insiders or adversaries who already hold a high-privilege operator foothold; no public exploit code and no CISA KEV activity were identified at time of analysis, and the EPSS score of 1.16% (66th percentile) indicates low observed exploitation likelihood. Patch guidance is published in TeamViewer security bulletin TV-2025-1006.
Information disclosure in TeamViewer DEX Client (formerly 1E Client) prior to version 25.11 for Windows lets an attacker positioned on the same adjacent network segment coerce the NomadBranch.exe Content Distribution Service into sending data to an arbitrary internal IP address. No authentication or user interaction is required once network adjacency is achieved, and the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality with no integrity or availability effect, giving a base score of 6.5. Exploitation is not confirmed as active (no CISA KEV listing), no public exploit code has been identified at time of analysis, and EPSS is a low 0.20% (9th percentile); the operative barriers are the mandatory adjacent-network foothold, the presence of the vulnerable function on a pre-25.11 build, and exposure of the content-distribution service.
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthenticated attackers on an adjacent network to bypass file integrity validation by supplying a valid hash for a malicious file. The Content Distribution Service (NomadBranch.exe) then incorrectly trusts and processes the file, executing code in the service context. No public exploit code has been identified, and the EPSS score is low (0.30%), but the CVSS base score of 8.8 reflects high impact to confidentiality, integrity, and availability. This is a moderately high-priority vulnerability but not an emergency.
Denial of service in TeamViewer DEX Client (formerly 1E Client) for Windows prior to version 25.11 lets an unauthenticated attacker who is already on the same adjacent network segment crash the Content Distribution Service (NomadBranch.exe) with a crafted command, terminating the service process. Impact is limited to availability (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity effect and the service can be restarted on the host - so exploitation is only possible laterally from the local network and not from the internet, and hosts on 25.11 or later are unaffected. There is no public exploit identified at time of analysis and no KEV listing; EPSS is low at 0.21% (11th percentile), consistent with a moderate, availability-only issue of limited real-world urgency.
Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can lead to unintentional sharing of the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to elevate privileges by changing the personal. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in TeamViewer 14.2.2558. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes it easier to determine the correct value. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] and "[00 00 00]" delimiters, which might make it easier for attackers to obtain. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.