CVE-2026-19743

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients

State: Published
Severity: 7.8 High
Published: Sep 29, 2026
Updated: Sep 30, 2026
Reserved: Aug 13, 2026

Description

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	TV

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Full ClientTeamViewer	15.0 to before 15.82Affected 15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected 14.7.0 (Windows) to before 14.7.48855 (Windows)Affected 13.2.0 (Windows) to before 13.2.36230 (Windows)Affected 14.7.0 (Linux) to before 14.7.48855 (Linux)Affected 13.2.0 (Linux) to before 13.2.153995 (Linux)Affected 14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected 13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected
HostTeamViewer	15.0 to before 15.82Affected 15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected 14.7.0 (Windows) to before 14.7.48855 (Windows)Affected 13.2.0 (Windows) to before 13.2.36230 (Windows)Affected 14.7.0 (Linux) to before 14.7.48855 (Linux)Affected 13.2.0 (Linux) to before 13.2.153995 (Linux)Affected 14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected 13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected

Product

Versions

Full ClientTeamViewer

15.0 to before 15.82Affected
15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected
14.7.0 (Windows) to before 14.7.48855 (Windows)Affected
13.2.0 (Windows) to before 13.2.36230 (Windows)Affected
14.7.0 (Linux) to before 14.7.48855 (Linux)Affected
13.2.0 (Linux) to before 13.2.153995 (Linux)Affected
14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected
13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected

HostTeamViewer

15.0 to before 15.82Affected
15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected
14.7.0 (Windows) to before 14.7.48855 (Windows)Affected
13.2.0 (Windows) to before 13.2.36230 (Windows)Affected
14.7.0 (Linux) to before 14.7.48855 (Linux)Affected
13.2.0 (Linux) to before 13.2.153995 (Linux)Affected
14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected
13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.