Vulnerability · Published Sep 29, 2026 · Assigned by TV
CVE-2026-92369Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
High 7.3
In plain English
A high-severity security flaw in Full Client from TeamViewer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TeamViewer | Full Client | 15.0 – before 15.8215.64.0 (Legacy Windows 7 & 8) – before 15.64.8 (Legacy Windows 7 & 8)14.7.0 – before 14.7.4885513.2.0 – before 13.2.36230 |
| TeamViewer | Host | 15.0 – before 15.8215.64.0 (Legacy Windows 7 & 8) – before 15.64.8 (Legacy Windows 7 & 8)14.7.0 – before 14.7.4885513.2.0 – before 13.2.36230 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H