CVE-2025-36537: falha de alta gravidade em TeamViewer Host
Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7epss 0.2%
Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
TeamViewer · Full ClientTeamViewer · Full Client (Win7/8)TeamViewer · HostTeamViewer · Host (Win7/8)CVEs relacionadas — TeamViewer Host
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19042HIGHCommand Injection in TeamViewer Desktop Client for Linux through Chat Link HandlingEPSS 1.8%CVE-2026-92372HIGHOut-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code ExecutionEPSS 0.4%CVE-2026-92370HIGHRemote Session Access Control Bypass Leading to Remote Code ExecutionEPSS 0.4%CVE-2026-111585HIGHInteger Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer OverflowEPSS 0.3%CVE-2026-111583HIGHLocal Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for WindowsEPSS 0.2%CVE-2026-92368HIGHHeap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code ExecutionEPSS 0.2%