CVE-2026-111584

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

State: Published
Severity: 7.3 High
Published: Oct 27, 2026
Updated: Oct 27, 2026
Reserved: Oct 16, 2026

Description

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	TV

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
TeamViewer Remote - Patch ManagementTeamViewer	before 26.9.1Affected 0 (Legacy version for v14.7 client) to before 24.12.5 (Legacy version for v14.7 client)Affected

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.