CVE-2026-92369: TeamViewer Race Condition Vulnerability

CVE-2026-92369 Overview

CVE-2026-92369 is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] in the TeamViewer Full Client and Host installer for Windows. The flaw resides in the installer rollback mechanism, which restores backup files from a user-writable temporary directory during a failed installation or update. A local, low-privileged attacker can replace those backup files between the check and the restore operation. When the elevated installer completes the rollback, attacker-controlled content executes as NT AUTHORITY\SYSTEM. TeamViewer addressed the issue in version 15.82 on Windows.

Critical Impact
Successful exploitation grants full SYSTEM privileges on the affected Windows host, giving the attacker complete control over the operating system.

Affected Products

TeamViewer Full Client on Windows prior to version 15.82
TeamViewer Host on Windows prior to version 15.82
Deployments performing installer rollback during install or update operations

Discovery Timeline

2026-09-29 - CVE-2026-92369 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-92369

Vulnerability Analysis

The vulnerability is a classic TOCTOU race condition [CWE-367] in the Windows installer's rollback path. During install or update, the TeamViewer installer stores rollback backup files inside a temporary directory that is writable by standard, non-privileged users. When an install or update fails and rollback triggers, the elevated installer reads those backup files and restores them into privileged locations without validating that the files remain trustworthy between check and use.

A local attacker with low privileges can monitor the rollback directory and swap a legitimate backup file for a malicious payload during the narrow window before the elevated process restores it. Exploitation requires user interaction to initiate an install, update, or rollback event, and depends on winning the race window.

Root Cause

The root cause is trust placed in files stored in a user-writable path. The installer assumes the backup files created earlier in the workflow are intact and controlled solely by the elevated process. Because standard users retain write access to the temporary directory, an attacker can replace file contents after the installer's initial validation but before restoration.

Attack Vector

The attack requires local access with low privileges and user interaction, since exploitation depends on an installation, update, or rollback event. The attacker plants a watcher that races the elevated installer, replacing backup files with malicious equivalents. When rollback proceeds, the installer copies attacker-controlled content into privileged locations, resulting in privilege escalation to NT AUTHORITY\SYSTEM.

No public proof-of-concept exploit code is available. Refer to the TeamViewer Security Bulletin TV-2026-1010 for vendor technical details.

Detection Methods for CVE-2026-92369

Indicators of Compromise

Unexpected file replacements or handle activity in TeamViewer installer temporary directories during install, update, or rollback operations
Creation of new SYSTEM-owned processes spawned as children of the TeamViewer installer service
Persistence artifacts (services, scheduled tasks, or DLLs) written to privileged paths shortly after a TeamViewer install or update event

Detection Strategies

Monitor process lineage for elevated TeamViewer installer processes that spawn unexpected child processes such as cmd.exe, powershell.exe, or unsigned binaries
Alert on file writes by low-privileged users to directories subsequently read by an elevated installer process
Correlate installer failure or rollback events with SYSTEM-level process creation within a short time window

Monitoring Recommendations

Enable command-line and process-creation auditing on endpoints running TeamViewer to capture rollback-triggered execution chains
Track the TeamViewer service and installer binaries for version drift; flag hosts still running versions prior to 15.82
Review endpoint telemetry for repeated install or update failures, which may indicate deliberate attempts to force rollback

How to Mitigate CVE-2026-92369

Immediate Actions Required

Upgrade all TeamViewer Full Client and Host installations on Windows to version 15.82 or later
Inventory endpoints running vulnerable TeamViewer versions and prioritize multi-user or shared systems
Restrict local logon on hosts running TeamViewer to trusted, authenticated users

Patch Information

TeamViewer resolved CVE-2026-92369 in version 15.82 of the Full Client and Host on Windows. The vendor's remediation details are published in the TeamViewer Security Bulletin TV-2026-1010. Administrators should validate patch deployment by confirming the installed version reported by each endpoint.

Workarounds

Where immediate patching is not possible, avoid initiating TeamViewer installs or updates on systems where untrusted local users are active
Enforce least-privilege policies to reduce the population of local accounts able to write to installer temporary directories
Monitor installer temporary directories for unauthorized file modifications during install and update windows

bash

# Verify the installed TeamViewer version on Windows (PowerShell)
Get-ItemProperty 'HKLM:\SOFTWARE\TeamViewer' | Select-Object -Property Version, InstallationDirectory