Vulnerability · Published Jun 24, 2025 · Assigned by TV
CVE-2025-36537Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
High 7.0
In plain English
A high-severity incorrect permission assignment in Full Client from TeamViewer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TeamViewer | Full Client | 15.0.0 – before 15.6714.0.0 – before 14.7.4880913.0.0 – before 13.2.3622712.0.0 – before 12.0.25932511.0.0 – before 11.0.259324 |
| TeamViewer | Host | 15.0.0 – before 15.6714.0.0 – before 14.7.4880913.0.0 – before 13.2.3622712.0.0 – before 12.0.25932511.0.0 – before 11.0.259324 |
| TeamViewer | Full Client (Win7/8) | 15.0.0 – before 15.64.5 |
| TeamViewer | Host (Win7/8) | 15.0.0 – before 15.64.5 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H