IT SBIT Services
Schneeberger
DEEN
CVE tracker

TeamViewer Full Client and Host: Local privilege escalation via DLL sideloading

CVE-2026-92377High 7.8

← All vulnerabilities

Summary

TeamViewer Full Client and Host for Windows contain a flaw in the Patch Management update mechanism. A local attacker with low privileges can send a forged IPC response, making a signed executable load a malicious DLL from a user-writable temporary directory. Successful exploitation leads to arbitrary code execution with NT AUTHORITY\SYSTEM privileges, provided the attacker already has a local logon on the affected system.

Affected

  • TeamViewer Full Client and Host for Windows prior to 15.82 (CVE record)
  • Legacy Windows 7 and 8: 15.64.0 to before 15.64.10 (CNA range data, not verified against the vendor bulletin)
  • 14.7.0 to before 14.7.48868 (CNA range data, not verified against the vendor bulletin)
  • 13.2.0 to before 13.2.36231 (CNA range data, not verified against the vendor bulletin)
  • Affected are both the Full Client and the Host, as listed in the CNA record

Fixed in

  • Version 15.82 or later according to the CVE record
  • The vendor bulletin TV-2026-1012 recommends version 15.83 or the latest available version, because 15.82 is still exposed to a separate remote flaw
  • Fixed versions for the legacy branches: Unknown (CNA range data only, not verified against the vendor bulletin)

Workaround

  • Unknown. The vendor bulletin only recommends the update.
  • Interim measures (own suggestions, not from the vendor): restrict write access to temporary directories on Windows endpoints, limit local logon rights, and remove Patch Management where it is not needed.

Exploitation

  • The vendor is not aware of any active exploitation in the wild at the time of publication.
  • No public exploit code has been confirmed.
  • According to an aggregator, the vulnerability is not in the CISA KEV catalog; the CISA catalog was not checked directly.
  • OffSeq rates it as not known to be exploited.
  • The EPSS score of 0.11 % is unverified.

Our recommendation

  • Update TeamViewer Full Client and Host for Windows to version 15.83 or the latest available version, and check the legacy branches against the vendor bulletin.
  • Inventory all Windows endpoints with TeamViewer and check the installed version.
  • Remove Patch Management where it is not needed.
  • Restrict local logon rights and write access to temporary directories as an interim measure.
  • Monitor endpoints for unexpected DLL loads and processes running as SYSTEM.
  • Note: VulDB rates the issue CVSS 8.8 with CWE-284, while the CNA/NVD record uses 7.8 and CWE-732.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:12.

Original description (NVD)

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed