The flaw arises from insecure link resolution before file access within the DeleteFileByPath instruction of TeamViewer DEX’s 1E‑Client. An attacker with low‑privileged local access can craft a symbolic link or RPC junction to point to protected system files. When the client resolves the link and deletes it, the attacker deletes critical files, potentially compromising the system’s integrity and enabling further privilege escalation.

TeamViewer’s Digital Employee Experience (DEX) 1E‑Client running on Windows prior to version 26.1. Only Windows hosts that have the DEX client installed and are exposed to local users are impacted.

The CVSS score of 5.7 denotes moderate severity, while the EPSS < 1 % suggests a low probability of public exploitation. The vulnerability requires local execution; an attacker must have local user or process access and uses the DeleteFileByPath RPC control. Because it is not listed in the CISA KEV catalog, no publicly known exploits are documented, but the local impact is sufficient for administrators to apply the vendor patch promptly.