Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 15.82, 15.64.10 (Legacy Windows 7 & 8), 14.7.48868, 13.2.36231
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
TeamViewer Full Client and Host for Windows, in versions before the fix, is affected. A local user with low privileges could abuse the Patch Management update mechanism to run malicious code with full SYSTEM privileges on the affected computer.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- TeamViewer Full Client
fixed in 15.82; From 15.64.0 (Legacy Windows 7 & 8) · fixed in 15.64.10 (Legacy Windows 7 & 8); From 14.7.0 · fixed in 14.7.48868; From 13.2.0 · fixed in 13.2.36231
- TeamViewer Host
fixed in 15.82; From 15.64.0 (Legacy Windows 7 & 8) · fixed in 15.64.10 (Legacy Windows 7 & 8); From 14.7.0 · fixed in 14.7.48868; From 13.2.0 · fixed in 13.2.36231