CVE-2026-111583 in Full Client
Summary
by MITRE • 10/27/2026
Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in TeamViewer Full Client and Host versions prior to 15.82 for Windows represents a critical failure in access control mechanisms within the software installation process, specifically affecting the Advanced Asset Management component. This flaw allows any local authenticated user with low privileges to escalate their rights to SYSTEM level by exploiting improper permissions on the installer staging directory. The core technical issue stems from the way the application handles file creation and execution during the setup phase for advanced features like asset management services. When a standard user initiates or interacts with the installation process, the system creates temporary files in a shared staging area that lacks strict ownership or access restrictions. This misconfiguration enables an attacker to manipulate these transient files before they are processed by the privileged installer service.
The operational mechanism of this exploitation relies on the principle of insecure default permissions within Windows temporary directories and application-specific staging areas. An attacker with low-level privileges can place a crafted installer options file into this directory, effectively hijacking the configuration parameters that the Advanced Asset Management installer reads during its activation sequence. Because the subsequent service execution runs under the highly privileged SYSTEM account, it blindly trusts and executes commands or configurations derived from these manipulated files without validating their integrity or origin. This constitutes a classic path traversal or race condition scenario where the timing of file creation allows an unprivileged user to inject malicious payloads that are then executed with elevated privileges by the system service.
From a security standards perspective, this vulnerability aligns closely with CWE-250, which describes execution with unnecessary privileges, and CWE-732, pertaining to improper access control in configuration files or directories. The attack vector is classified under ATT&CK technique T1068, specifically the exploitation of software vulnerabilities for privilege escalation, as well as T1546, Event Triggered Execution, since the malicious code executes automatically upon service activation triggered by the installation process. This combination allows an attacker to bypass standard security boundaries that typically protect system-level operations from user-initiated actions.
The impact of this vulnerability is severe due to the resulting SYSTEM level access. Once an attacker achieves execution as NT AUTHORITY\SYSTEM, they gain unrestricted control over the operating system. This includes the ability to install rootkits, modify critical registry keys, create new administrative accounts, or exfiltrate sensitive data without detection by standard user-level security controls. The presence of Advanced Asset Management does not mitigate this risk; rather, its installation process becomes the primary attack surface for privilege escalation within an otherwise secure environment.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The most effective remediation is to upgrade TeamViewer Full Client and Host to version 15.82 or later, where these access control issues have been addressed by developers through stricter permission checks on the installer staging directory. In environments where upgrading is not immediately feasible, administrators should restrict write permissions to the relevant installation directories for standard users, ensuring that only trusted system accounts can create or modify files in those locations. Additionally, implementing application whitelisting policies and monitoring for unusual file creation events in temporary directories can help detect attempts at this exploitation technique before they result in full system compromise.