A high-severity vulnerability, CVE-2025-36537, has been identified in the TeamViewer Remote Management solution for Windows. This flaw enables local attackers to delete arbitrary files with SYSTEM privileges via a misuse of the MSI rollback mechanism, potentially leading to privilege escalation. The vulnerability affects TeamViewer’s Remote Management features (Backup, Monitoring, Patch Management) and not standard installations. TeamViewer has released a patch and urges users to upgrade to version 15.67 or later.
Risks:
CVE-2025-36537 is categorized under CWE-732 (Incorrect Permission Assignment for Critical Resource) and has a CVSS score of 7.0. The flaw allows a local unprivileged user to trigger SYSTEM-level file deletions without user interaction. This can be used in a privilege escalation chain to disable security components or take full control of a system. The vulnerability does not affect remote-only setups but poses a significant risk in environments where attackers have local access.
Affected Version:
TeamViewer Remote Full Client (Windows) < 15.67
TeamViewer Remote Full Client (Windows 7/8) < 15.64.5
TeamViewer Remote Host (Windows) < 15.67
TeamViewer Remote Host (Windows 7/8) < 15.64.5
Legacy versions back to 11.0.259324
These versions are vulnerable if Remote Management features are enabled. Systems running only basic TeamViewer installations are not impacted.
Remediation:
TeamViewer has issued patches to address this issue. Users are strongly advised to update to:
Version 15.67 or later for current systems
Version 15.64.5 or later for Windows 7/8 systems
Organizations should audit their installations for use of Remote Management features and apply updates immediately. No exploitation has been detected in the wild, but the public disclosure increases the risk of future attacks.
Conclusion:
CVE-2025-36537 represents a serious vulnerability for systems utilizing TeamViewer’s Remote Management functionality. While it requires local access to exploit, its ability to grant SYSTEM privileges makes it critical to address. Organizations should prioritize patching all affected systems to minimize potential exploitation.
