Vulnerability details
CVE-2026-92369
TeamViewer Full ClientTeamViewer Host
Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
CVSS 3.1
7.3High
Official description
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.3High | 3.1 | CVEProject cvelistV5 (CNA) (TV) | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TeamViewer | Full Client | 13.2.0 ≤ v < 13.2.36230 | CVEProject cvelistV5 (CNA) |
| TeamViewer | Full Client | 14.7.0 ≤ v < 14.7.48855 | CVEProject cvelistV5 (CNA) |
| TeamViewer | Full Client | 15.0 ≤ v < 15.82 | CVEProject cvelistV5 (CNA) |
| TeamViewer | Full Client | 15.64.0 (Legacy Windows 7 & 8) ≤ v < 15.64.8 (Legacy Windows 7 & 8) | CVEProject cvelistV5 (CNA) |
| TeamViewer | Host | 13.2.0 ≤ v < 13.2.36230 | CVEProject cvelistV5 (CNA) |
| TeamViewer | Host | 14.7.0 ≤ v < 14.7.48855 | CVEProject cvelistV5 (CNA) |
| TeamViewer | Host | 15.0 ≤ v < 15.82 | CVEProject cvelistV5 (CNA) |
| TeamViewer | Host | 15.64.0 (Legacy Windows 7 & 8) ≤ v < 15.64.8 (Legacy Windows 7 & 8) | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-29
- Last updated
- 2026-09-30
- State
- Published
- Assigner (CNA)
- TV
Exploit prediction (EPSS)
0.09%
Probability of exploitation in 30 days
0.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-367Time-of-check time-of-use (TOCTOU) race condition