7.8Alta
CVE-2026-19743Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
Descripción
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
Debilidad (CWE):
CWE-22
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| TeamViewer | Full Client | 15.0 – < 15.82, 15.64.0 (Legacy Windows 7 & 8) – < 15.64.8 (Legacy Windows 7 & 8), 14.7.0 (Windows) – < 14.7.48855 (Windows), 13.2.0 (Windows) – < 13.2.36230 (Windows), 14.7.0 (Linux) – < 14.7.48855 (Linux), 13.2.0 (Linux) – < 13.2.153995 (Linux), 14.7.0 (MacOS) – < 14.7.48855 (MacOS), 13.2.0 (MacOS) – < 13.2.153994 (MacOS) | |
| TeamViewer | Host | 15.0 – < 15.82, 15.64.0 (Legacy Windows 7 & 8) – < 15.64.8 (Legacy Windows 7 & 8), 14.7.0 (Windows) – < 14.7.48855 (Windows), 13.2.0 (Windows) – < 13.2.36230 (Windows), 14.7.0 (Linux) – < 14.7.48855 (Linux), 13.2.0 (Linux) – < 13.2.153995 (Linux), 14.7.0 (MacOS) – < 14.7.48855 (MacOS), 13.2.0 (MacOS) – < 13.2.153994 (MacOS) |