Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2025-36537

Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TV

Description

Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TeamViewer Full Client

Default version status: unaffected

  • 15.0.0 to < 15.67affected
  • 14.0.0 to < 14.7.48809affected
  • 13.0.0 to < 13.2.36227affected
  • 12.0.0 to < 12.0.259325affected
  • 11.0.0 to < 11.0.259324affected

TeamViewer Host

Default version status: unaffected

  • 15.0.0 to < 15.67affected
  • 14.0.0 to < 14.7.48809affected
  • 13.0.0 to < 13.2.36227affected
  • 12.0.0 to < 12.0.259325affected
  • 11.0.0 to < 11.0.259324affected

TeamViewer Full Client (Win7/8)

Default version status: unaffected

  • 15.0.0 to < 15.64.5affected

TeamViewer Host (Win7/8)

Default version status: unaffected

  • 15.0.0 to < 15.64.5affected

References