Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows allows a local attacker with low privileges to supply a signed executable through a forged IPC response. The attacker can then cause the legitimate application to load a malicious DLL from a user‑writable temporary directory, resulting in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

TeamViewer Full Client and TeamViewer Host installations on Windows that are running any version prior to 15.82 are affected.

The vulnerability has a CVSS score of 7.8, indicating a high potential impact. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting that exploitation has not yet been widely reported. However, the requirement for only local authenticated users with low privileges lowers the barrier for attackers, making privilege escalation a credible threat.