TeamViewer Full Client and Host versions prior to 15.82 on Windows have a time-of-check to time-of-use (TOCTOU) race condition in the installer rollback mechanism. This vulnerability allows a local low-privileged attacker to replace rollback backup files in a user-writable temporary directory before they are restored by an elevated installer, potentially escalating privileges to NT AUTHORITY/SYSTEM. Exploitation requires precise timing of the race condition during an installation or update rollback.