BaseFortify

Publication date: 2025-10-01

Last updated on: 2025-10-02

Assigner: TeamViewer Germany GmbH

Description

Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-01

Last Modified

2025-10-02

Generated

2026-07-06

AI Q&A

2025-10-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-41421

EUVD

EUVD-2025-32723

Affected Vendors & Products

Vendor	Product	Version / Range
teamviewer	teamviewer_host	*
teamviewer	tensor	*
teamviewer	teamviewer_full_client	*
teamviewer	teamviewer_remote	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of symbolic links in TeamViewer Full Client and Host for Windows versions prior to 15.70. An attacker with local, unprivileged access on a device without adequate malware protection can exploit this by spoofing the update file path, leading to privilege escalation.

Impact Analysis

The vulnerability can allow an attacker to escalate their privileges on the affected system, potentially resulting in unauthorized access to sensitive information.

Hi! I’m here to help you understand CVE-2025-41421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70