CVE-2026-92369: Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TeamViewer Full Client and Hostto a version that resolves this vulnerability.Fixed in 15.82
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Windows systems running TeamViewer Full Client or Host versions earlier than 15.82 are affected. The issue is limited to the installer or update rollback mechanism.
What does an attacker need to exploit it?
An attacker needs local low-privileged access and must be able to win a timing race by replacing rollback backup files in a user-writable temporary directory. A rollback must occur during a TeamViewer installation or update.
Is exploitation automatic during every installation or update?
No. Exploitation requires both a rollback event and successful timing of the race condition before the elevated installer restores the backup files.
What is the potential impact if exploitation succeeds?
A successful attacker can escalate privileges to NT AUTHORITY/SYSTEM, gaining high-impact access to the affected Windows system.