A race condition in the directory validation logic of the TeamViewer Full Client and Host prior to version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges. This vulnerability can potentially lead to a denial-of-service condition through symbolic link manipulation during directory verification.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-44002 |
Exploitation
To exploit this vulnerability, an attacker with local access can manipulate symbolic links during the directory verification process in the TeamViewer application. By doing so, they can create arbitrary files with SYSTEM privileges, which may lead to a denial-of-service condition.
Affected Products
- TeamViewer Full Client: The application prior to version 15.69 is vulnerable to this race condition, allowing unauthorized file creation.
- TeamViewer Host: Similar to the Full Client, the Host version prior to 15.69 is also affected by this vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to TeamViewer version 15.69 or later. Additionally, restricting local access to the application can help prevent exploitation until the update is applied.