Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 15.83, 14.7.48868, 13.2.154007
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
TeamViewer Full Client and TeamViewer Host installed on macOS are affected by this flaw. A local user with low-level access could exploit it to bypass installer checks, install a malicious package, and gain root-level control of the system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- TeamViewer Full Client
fixed in 15.83; From 14.7.0 · fixed in 14.7.48868; From 13.2.0 · fixed in 13.2.154007
- TeamViewer Host
fixed in 15.83; From 14.7.0 · fixed in 14.7.48868; From 13.2.0 · fixed in 13.2.154007