TeamViewer Full Client and Host Directory Validation Race Condition Vulnerability Allowing Arbitrary File Creation with SYSTEM Privileges

A race condition vulnerability has been identified in the directory validation logic of the TeamViewer Full Client and Host for Windows, prior to version 15.69. This vulnerability allows a local non-administrative user to create arbitrary files with SYSTEM privileges, potentially causing a denial-of-service condition. The issue arises from symbolic link manipulation during the directory verification process.

Impact

Exploitation of this vulnerability can lead to arbitrary file creation with SYSTEM privileges, causing a local denial-of-service condition.

Remediation

Users are advised to update to TeamViewer version 15.69 or the latest available version.