CVE-2025-41421
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-01

Last updated on: 2025-10-02

Assigner: TeamViewer Germany GmbH

Description
Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-01
Last Modified
2025-10-02
Generated
2026-06-16
AI Q&A
2025-10-01
EPSS Evaluated
2026-06-14
NVD
CVE-2025-41421
EUVD
EUVD-2025-32723
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
teamviewer teamviewer_host *
teamviewer tensor *
teamviewer teamviewer_full_client *
teamviewer teamviewer_remote *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of symbolic links in TeamViewer Full Client and Host for Windows versions prior to 15.70. An attacker with local, unprivileged access on a device without adequate malware protection can exploit this by spoofing the update file path, leading to privilege escalation.

Impact Analysis

The vulnerability can allow an attacker to escalate their privileges on the affected system, potentially resulting in unauthorized access to sensitive information.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-41421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart