The vulnerability is a time‑of‑check time‑of‑use race condition in TeamViewer's installer rollback mechanism that allows a low‑privileged local user to replace rollback backup files stored in a writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to the SYSTEM account. This is a local privilege escalation flaw (CWE‑367) that can be leveraged to gain unrestricted system access on Windows.

The flaw affects TeamViewer Full Client and TeamViewer Host on Windows versions prior to 15.82. The installer rollback mechanism is used during any installation or update where the update process is rolled back; the affected files are located in a user‑writable temporary directory.

The CVSS score for this vulnerability is 7.3, indicating a medium‑to‑high severity. Because the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the likelihood of exploitation is unknown but could still be significant in environments where the installer rollback feature is frequently used. The attack requires a local low‑privileged user to time the race condition during an installation or update; exploitation is not possible from a remote host.