Arbitrary File Creation via Symbolic Link Leading to Denial-of-Service

CVE-ID

CVE-2025-44002

Description

Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.

 

To exploit this vulnerability, an attacker needs local access to the Windows system.

 

We have no indication that this vulnerability has been or is being exploited in the wild.

 

The vulnerability has been fixed with version 15.69 and additional versions listed below. We recommend updating to the latest available version.

CVSS3.1 Score

Base Score 6.1 (Medium)

CVSS3.1 Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Problem type

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

TeamViewer Remote Full Client (Windows)

< 15.69

Download available

TeamViewer Remote Host (Windows)

< 15.69

Download available