What’s Vulnerable › Vulnerabilities
CVE-2025-41421: Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-10-01 · updated 2026-10-18
- Weakness: CWE-59
Description
Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.
Affected products
- TeamViewer Full Client: from 11.0.0 before 15.70 — fixed in 15.70
- TeamViewer Host: from 11.0.0 before 15.70 — fixed in 15.70
How to fix
Upgrade to a fixed version: TeamViewer Full Client 15.70; TeamViewer Host 15.70. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-41421 or the next vulnerability affects your stack