CVE-2025-36537

Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management

High · published June 24, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.5th percentile
Published
2025-06-24T14:24Z
EPSS history
Timeline
  • 24 JUN 14:24Z
    Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management
    cvelistv5