CVE-2026-92369: CWE-367 Time-of-check time-of-use (TOCTOU) race condition in TeamViewer Full Client
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
AI Analysis
Technical Summary
This vulnerability is a TOCTOU race condition (CWE-367) in the rollback mechanism of the TeamViewer Full Client and Host installer on Windows. The rollback files are stored in a user-writable temporary directory, allowing a local attacker with low privileges to replace these files before the elevated installer restores them. Successful exploitation results in privilege escalation to NT AUTHORITY/SYSTEM. The affected versions are TeamViewer Full Client and Host versions >=13.2.0 <13.2.36230, >=14.7.0 <14.7.48855, and >=15.0 <15.82. The attack requires timing the race condition during an installation or update rollback. The CVSS v3.1 base score is 7.3, indicating high severity with impacts on confidentiality, integrity, and availability.
Potential Impact
A local attacker with low privileges can escalate to SYSTEM privileges by exploiting the race condition during the rollback phase of installation or update. This can lead to full system compromise with high impact on confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid performing rollback operations during installation or update in untrusted environments and restrict local user access to the temporary directories used by the installer rollback mechanism.
CVE-2026-92369: CWE-367 Time-of-check time-of-use (TOCTOU) race condition in TeamViewer Full Client
Description
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.
CVSS v3.1
Score 7.3high
Affected software
TeamViewer
Full Client
TeamViewer
Host
pkg:github/teamviewer/full-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a TOCTOU race condition (CWE-367) in the rollback mechanism of the TeamViewer Full Client and Host installer on Windows. The rollback files are stored in a user-writable temporary directory, allowing a local attacker with low privileges to replace these files before the elevated installer restores them. Successful exploitation results in privilege escalation to NT AUTHORITY/SYSTEM. The affected versions are TeamViewer Full Client and Host versions >=13.2.0 <13.2.36230, >=14.7.0 <14.7.48855, and >=15.0 <15.82. The attack requires timing the race condition during an installation or update rollback. The CVSS v3.1 base score is 7.3, indicating high severity with impacts on confidentiality, integrity, and availability.
Potential Impact
A local attacker with low privileges can escalate to SYSTEM privileges by exploiting the race condition during the rollback phase of installation or update. This can lead to full system compromise with high impact on confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid performing rollback operations during installation or update in untrusted environments and restrict local user access to the temporary directories used by the installer rollback mechanism.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TV
- Date Reserved
- 2026-09-16T07:16:01.956Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abbf0c2c9b3d5d17704c51b
Added to database: 09/29/2026, 17:09:22 UTC
Last enriched: 09/29/2026, 17:13:49 UTC
Last updated: 09/29/2026, 18:20:12 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.