Improper Validation of File Paths in TeamViewer Desktop Clients
Priority LOW 35CWE-73Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of the affected user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Fix Fixed Full Client, Host, QuickSupport & Portable (TeamViewer): 15.81.5Full Client, Host, QuickSupport & Portable (for Windows 7 & 8) (TeamViewer): 15.64.7+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TeamViewer | Full Client, Host, QuickSupport & Portable | 15.0 to before 15.81.5 | 15.81.5 | Patch available | CNA |
| TeamViewer | Full Client, Host, QuickSupport & Portable (for Windows 7 & 8) | 15.64.0 to before 15.64.7 | 15.64.7 | Patch available | CNA |
| TeamViewer | Full Client, Host, QuickSupport (v14 for Windows) | 14.0 to before 14.7.48833 | 14.7.48833 | Patch available | CNA |
| TeamViewer | Full Client, Host, QuickSupport (v14 for Linux) | 14.0 to before 14.7.48838 | 14.7.48838 | Patch available | CNA |
| TeamViewer | Full Client, Host, QuickSupport (v14 for macOS) | 14.0 to before 14.7.48838 | 14.7.48838 | Patch available | CNA |
| TeamViewer | Full Client, Host, QuickSupport & Portable (v13 for Windows) | 13.0 to before 13.2.36229 | 13.2.36229 | Patch available | CNA |
| TeamViewer | Full Client, Host, QuickSupport (v13 for Linux) | 13.0 to before 13.2.153978 | 13.2.153978 | Patch available | CNA |
| TeamViewer | Full Client, Host, QuickSupport (v13 for macOS) | 13.0 to before 13.2.153981 | 13.2.153981 | Patch available | CNA |
- Full Client, Host, QuickSupport & Portable VendorTeamViewer Affected 15.0 to before 15.81.5 Fixed in 15.81.5 Patch available CNA
- Full Client, Host, QuickSupport & Portable (for Windows 7 & 8) VendorTeamViewer Affected 15.64.0 to before 15.64.7 Fixed in 15.64.7 Patch available CNA
- Full Client, Host, QuickSupport (v14 for Windows) VendorTeamViewer Affected 14.0 to before 14.7.48833 Fixed in 14.7.48833 Patch available CNA
- Full Client, Host, QuickSupport (v14 for Linux) VendorTeamViewer Affected 14.0 to before 14.7.48838 Fixed in 14.7.48838 Patch available CNA
- Full Client, Host, QuickSupport (v14 for macOS) VendorTeamViewer Affected 14.0 to before 14.7.48838 Fixed in 14.7.48838 Patch available CNA
- Full Client, Host, QuickSupport & Portable (v13 for Windows) VendorTeamViewer Affected 13.0 to before 13.2.36229 Fixed in 13.2.36229 Patch available CNA
- Full Client, Host, QuickSupport (v13 for Linux) VendorTeamViewer Affected 13.0 to before 13.2.153978 Fixed in 13.2.153978 Patch available CNA
- Full Client, Host, QuickSupport (v13 for macOS) VendorTeamViewer Affected 13.0 to before 13.2.153981 Fixed in 13.2.153981 Patch available CNA
Remediation
- Fix · CNA Full Client, Host, QuickSupport & Portable (TeamViewer) Fixed in 15.81.5
- Fix · CNA Full Client, Host, QuickSupport & Portable (for Windows 7 & 8) (TeamViewer) Fixed in 15.64.7
- Fix · CNA Full Client, Host, QuickSupport (v14 for Windows) (TeamViewer) Fixed in 14.7.48833
- Fix · CNA Full Client, Host, QuickSupport (v14 for Linux) (TeamViewer) Fixed in 14.7.48838
- Fix · CNA Full Client, Host, QuickSupport (v14 for macOS) (TeamViewer) Fixed in 14.7.48838
- Fix · CNA Full Client, Host, QuickSupport & Portable (v13 for Windows) (TeamViewer) Fixed in 13.2.36229
- Fix · CNA Full Client, Host, QuickSupport (v13 for Linux) (TeamViewer) Fixed in 13.2.153978
- Fix · CNA Full Client, Host, QuickSupport (v13 for macOS) (TeamViewer) Fixed in 13.2.153981
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16444
- 2026-10-03 Alias added: GHSA-3mf4-g44r-xcvg
References
More TeamViewer vulnerabilities
- TI-2019-13681 TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control… KEVCVSS 3.1HIGH 7.0
- TI-2020-10745 TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI… CVSS 3.1HIGH 8.8
- TI-2010-02989 Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local… CVSS 2.0HIGH 9.3
- TI-2021-13849 Memory corruption in TeamViewer CVSS 3.1HIGH 8.8
- TI-2018-11870 TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force… CVSS 3.0CRITICAL 9.8
- TI-2025-28565 File Hash Validation Bypass in NomadBranch.exe CVSS 3.1HIGH 8.8
Sources
- CVE-2026-16444 · CVE Program
- CVE-2026-16444 · NVD
- FIRST EPSS
- GHSA-3mf4-g44r-xcvg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences