CVE-2026-92377
Received
Received - Intake
Improper Access Control in TeamViewer Windows Client
Vulnerability report for CVE-2026-92377, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-27
Last updated on: 2026-10-27
Assigner: TeamViewer Germany GmbH
Description
Description
Improper access control in the Patch
Management update mechanism of TeamViewer Full Client and Host for Windows
prior to version 15.82 allows a local authenticated attacker with low
privileges to supply a signed executable through a forged IPC response and
cause it to load a malicious DLL from a user-writable temporary directory.
Successful exploitation results in arbitrary code execution with NT
AUTHORITY\SYSTEM privileges.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TeamViewer | Full Client | 0 |
| TeamViewer | Full Client | 15.64.0 (Legacy Windows 7 & 8) |
| TeamViewer | Full Client | 14.7.0 |
| TeamViewer | Full Client | 13.2.0 |
| TeamViewer | Host | 0 |
| TeamViewer | Host | 15.64.0 (Legacy Windows 7 & 8) |
| TeamViewer | Host | 14.7.0 |
| TeamViewer | Host | 13.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
