CVE-2026-19743: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TeamViewer Full Client and Hostto a version that resolves this vulnerability.Fixed in 15.82
Event History
Frequently Asked Questions
Who can exploit this issue?
A local authenticated user with low privileges on a Windows, Linux, or macOS system running an affected TeamViewer Full Client or Host can exploit it. Remote unauthenticated attackers are not described as being able to trigger the issue directly.
What access does an attacker need to exploit it?
The attacker needs local authenticated access and the ability to send crafted commands to the TeamViewer local IPC service daemon. No user interaction is required once those conditions are met.
What is the impact of successful exploitation?
Successful exploitation allows arbitrary file writes with elevated privileges: NT AUTHORITY/SYSTEM on Windows or root on Linux and macOS. This can result in local privilege escalation and compromise of confidentiality, integrity, and availability.
Which installations should be remediated?
TeamViewer Full Client and TeamViewer Host installations on Windows, Linux, and macOS before version 15.82 are affected. Update affected clients and hosts to version 15.82 or later.