CVE-2025-36537: TeamViewer Full Client

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.

Affected products

• TeamViewer Full Client: from 15.0.0, before 15.67 (fixed in 15.67); from 14.0.0, before 14.7.48809 (fixed in 14.7.48809); from 13.0.0, before 13.2.36227 (fixed in 13.2.36227); from 12.0.0, before 12.0.259325 (fixed in 12.0.259325); from 11.0.0, before 11.0.259324 (fixed in 11.0.259324)
• TeamViewer Full Client WIN7/8: from 15.0.0, before 15.64.5 (fixed in 15.64.5)
• TeamViewer Host: from 15.0.0, before 15.67 (fixed in 15.67); from 14.0.0, before 14.7.48809 (fixed in 14.7.48809); from 13.0.0, before 13.2.36227 (fixed in 13.2.36227); from 12.0.0, before 12.0.259325 (fixed in 12.0.259325); from 11.0.0, before 11.0.259324 (fixed in 11.0.259324)
• TeamViewer Host WIN7/8: from 15.0.0, before 15.64.5 (fixed in 15.64.5)

Published 2025-06-24. Last modified 2026-06-17.