TeamViewer: Local privilege escalation via installer staging (CVE-2026-111583)
An improper access control vulnerability in the TeamViewer installer staging directory allows local low-privileged users to achieve arbitrary code execution as SYSTEM via a crafted installer options file.
CVE search metadata
CVE search record: CVE-2026-111583. Severity: high. CVSS: 7.3. KEV: no. Product: TeamViewer Full Client (< 15.82), TeamViewer Host (< 15.82), TeamViewer Full Client (< 15.83), TeamViewer Portable (< 15.83), TeamViewer Remote Control App (< 15.83), TeamViewer Host (< 15.83). Brief: TeamViewer: Local privilege escalation via installer staging (CVE-2026-111583). Brief link: https://feed.craftedsignal.io/briefs/2026-10-teamviewer-lpe/
CVE search record: CVE-2026-111585. Severity: high. CVSS: 8.8. KEV: no. Product: TeamViewer Full Client (< 15.82), TeamViewer Host (< 15.82), TeamViewer Full Client (< 15.83), TeamViewer Portable (< 15.83), TeamViewer Remote Control App (< 15.83), TeamViewer Host (< 15.83). Brief: TeamViewer: Local privilege escalation via installer staging (CVE-2026-111583). Brief link: https://feed.craftedsignal.io/briefs/2026-10-teamviewer-lpe/
CVE search record: CVE-2026-92372. Severity: high. CVSS: 8.8. KEV: no. Product: TeamViewer Full Client (< 15.82), TeamViewer Host (< 15.82), TeamViewer Full Client (< 15.83), TeamViewer Portable (< 15.83), TeamViewer Remote Control App (< 15.83), TeamViewer Host (< 15.83). Brief: TeamViewer: Local privilege escalation via installer staging (CVE-2026-111583). Brief link: https://feed.craftedsignal.io/briefs/2026-10-teamviewer-lpe/
CVE search record: CVE-2026-92374. Severity: high. CVSS: 7.8. KEV: no. Product: TeamViewer Full Client (< 15.82), TeamViewer Host (< 15.82), TeamViewer Full Client (< 15.83), TeamViewer Portable (< 15.83), TeamViewer Remote Control App (< 15.83), TeamViewer Host (< 15.83). Brief: TeamViewer: Local privilege escalation via installer staging (CVE-2026-111583). Brief link: https://feed.craftedsignal.io/briefs/2026-10-teamviewer-lpe/
Triage facts
Revision 1- Applicability
- TeamViewer Full Client (< 15.82), TeamViewer Host (< 15.82) +4
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 4 public sources
- Freshness
- Revision 1Oct 27, 18:05 UTC
- Vulnerabilities
- 4 CVEs
- Source quality
- A2Roughly even chance
What's new
TeamViewer Full Client and Host for Windows versions prior to 15.82 are vulnerable to a local privilege escalation flaw. During the installation of the Advanced Asset Management component, the installer uses an insecurely permissioned staging directory. A local authenticated user with low privileges can place a crafted installer options file in this directory, which is then processed by the installer, resulting in execution of arbitrary commands with SYSTEM privileges during service activation.
Impact
Successful exploitation allows a local low-privileged user to gain full SYSTEM access on the affected Windows host.
Recommendation
- Update all instances of TeamViewer Full Client and TeamViewer Host to version 15.82 or later immediately.
- Review and restrict write permissions on installer staging directories if the upgrade cannot be performed immediately.
- Monitor local file system activity for unexpected file writes to TeamViewer staging directories by non-administrative users.
Immediate actions
Upgrade all TeamViewer Full Client and Host installations to version 15.82 or later.
Upgrade TeamViewer Full Client to 15.83 or later on all managed Linux and macOS assets.
Upgrade TeamViewer Full Client and Host to version 15.83 or later
Threat Hunt
Monitor file system modifications in TeamViewer temporary staging directories for files created or modified by non-SYSTEM, non-Admin users.
Data: File creation events (e.g., Sysmon Event ID 11) filtering for TeamViewer staging paths
Identify endpoints initiating TeamViewer connections to unknown or external IP addresses
Data: Firewall logs, Endpoint network connection logs
Identify endpoints running TeamViewer versions < 15.83 and investigate process lineage for child processes spawning from the TeamViewer binary.
Data: Endpoint detection and response (EDR) process telemetry, Asset management logs
Identify unauthorized or unexpected package installations in TeamViewer paths
Data: macOS Unified Logs, Endpoint management inventory data
Mitigations
Upgrade to version 15.82 or later.
CVE-2026-111583
Upgrade all TeamViewer clients to version 15.83 or later
CVE-2026-111585
Patch TeamViewer Full Client to 15.83 or newer.
CVE-2026-92372
Upgrade to version 15.83 or later
CVE-2026-92374