SecuriTricks - CVE-2025-44002

Description

Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.

Product(s) Impacted

Vendor	Product	Versions
Teamviewer	Teamviewer	<15.69

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	teamviewer	teamviewer	<15.69	/	/	/	/	/	/

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1003/

CVSS Score

6.1 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

View Vector String

Timeline

Published: Aug. 26, 2025, 11:15 a.m.
Last Modified: Aug. 26, 2025, 1:41 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

psirt@teamviewer.com

CVE-2025-44002