All vulnerabilities
CVE-2026-92369

Full Client: Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation

TeamViewer Full Client
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.09%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.82Also 15.64.8 (Legacy Windows 7 & 8), 14.7.48855 and 1 moreCVE List
Published29 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.

Text from CVE List

Affected versions 8

  • Full Clientaffected: 15.0 before 15.82CVE List
  • Full Clientaffected: 15.64.0 (Legacy Windows 7 & 8) before 15.64.8 (Legacy Windows 7 & 8)CVE List
  • Full Clientaffected: 14.7.0 before 14.7.48855CVE List
  • Full Clientaffected: 13.2.0 before 13.2.36230CVE List
  • Hostaffected: 15.0 before 15.82CVE List
  • Hostaffected: 15.64.0 (Legacy Windows 7 & 8) before 15.64.8 (Legacy Windows 7 & 8)CVE List
  • Hostaffected: 14.7.0 before 14.7.48855CVE List
  • Hostaffected: 13.2.0 before 13.2.36230CVE List

References 1