{"id":"CVE-2026-92377","kind":"vulnerability","aliases":["CVE-2026-92377"],"related":[],"title":"TeamViewer for Windows: local low-privilege user gains SYSTEM code execution","description":"Improper access control in the Patch\nManagement update mechanism of TeamViewer Full Client and Host for Windows\nprior to version 15.82 allows a local authenticated attacker with low\nprivileges to supply a signed executable through a forged IPC response and\ncause it to load a malicious DLL from a user-writable temporary directory.\nSuccessful exploitation results in arbitrary code execution with NT\nAUTHORITY\\SYSTEM privileges.","summary":"TeamViewer Full Client and Host for Windows before 15.82 has an access control flaw in its Patch Management update mechanism. A local user with low privileges can forge an IPC response, make the service load a malicious DLL from a user-writable temp directory, and run code as NT AUTHORITY\\SYSTEM.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","teamviewer","windows"],"not_affected_if":["already-on-15.82-or-later","no-local-untrusted-users"],"how_to_check":"- Check the installed TeamViewer version on Windows (Help > About TeamViewer, or the TeamViewer entry in Apps & features) and compare it with `15.82`.\n- Confirm whether the Patch Management feature is in use; the sources do not say how to confirm this from configuration.","fix":"- Update TeamViewer Full Client and Host for Windows to `15.82` or later.","status":"open","published_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:08+00:00","updated_at":"2026-10-27T16:34:08+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T16:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update TeamViewer Full Client and Host for Windows to `15.82` or later.","reach":"local","title":"TeamViewer for Windows: local low-privilege user gains SYSTEM code execution","impact":"high","summary":"TeamViewer Full Client and Host for Windows before 15.82 has an access control flaw in its Patch Management update mechanism. A local user with low privileges can forge an IPC response, make the service load a malicious DLL from a user-writable temp directory, and run code as NT AUTHORITY\\SYSTEM.","category":"package","nicknames":[],"who_cares":["windows","teamviewer","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local low-privilege user runs code as SYSTEM on Windows","analyst_note":"Sources do not say whether the flaw is limited to Patch Management being enabled, or confirm a vendor advisory; check the TeamViewer security bulletin for the exact default configuration.","how_to_check":"- Check the installed TeamViewer version on Windows (Help > About TeamViewer, or the TeamViewer entry in Apps & features) and compare it with `15.82`.\n- Confirm whether the Patch Management feature is in use; the sources do not say how to confirm this from configuration.","needs_analyst":true,"not_affected_if":["already-on-15.82-or-later","no-local-untrusted-users"],"who_is_affected":"Windows machines running TeamViewer Full Client or Host before `15.82`. The attacker must already have a local account on the machine, so exposure is mainly a concern on shared or multi-user Windows hosts, jump boxes and developer machines where untrusted local users exist. Machines with only remote access and no local untrusted users are less exposed, but the sources do not say they are unaffected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3360,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-92377':15A,18A '15.82':33B,97C 'access':36B,78C 'allow':98C 'arbitrari':135C 'attack':102C 'authent':101C 'author':75B,140C 'caus':117C 'client':27B,89C 'code':11A,72B,136C 'control':37B,79C 'cve':13A,16A 'directori':69B,130C 'dll':62B,123C 'execut':12A,110C,137C 'exploit':132C 'flaw':38B 'forg':52B,113C 'full':26B,88C 'gain':9A 'host':22B,29B,91C 'improp':77C 'ipc':54B,114C 'load':59B,120C 'local':4A,46B,100C 'low':6A,49B,104C 'low-privileg':5A 'make':56B 'malici':61B,122C 'manag':42B,83C 'mechan':44B,85C 'nt':74B,139C 'packag':19B 'patch':41B,82C 'prior':94C 'privileg':7A,50B,105C,142C 'respons':55B,115C 'result':133C 'run':71B 'self':21B 'self-host':20B 'servic':58B 'sign':109C 'success':131C 'suppli':107C 'system':10A,76B,141C 'teamview':1A,23B,25B,87C 'temp':68B 'temporari':129C 'updat':43B,84C 'user':8A,47B,66B,127C 'user-writ':65B,126C 'version':96C 'window':3A,24B,31B,93C 'writabl':67B,128C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running TeamViewer Full Client or Host before `15.82`. The attacker must already have a local account on the machine, so exposure is mainly a concern on shared or multi-user Windows hosts, jump boxes and developer machines where untrusted local users exist. Machines with only remote access and no local untrusted users are less exposed, but the sources do not say they are unaffected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@teamviewer.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92377","severity":null,"published_at":"2026-10-27T16:17:32+00:00","modified_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}