CVE-2026-16444: How a File Transfer Feature in TeamViewer Became an Arbitrary File Write Vulnerability

CVE-2026-16444: How a File Transfer Feature in TeamViewer Became an Arbitrary File Write Vulnerability

TL;DR: TeamViewer patched a high-severity path traversal bug (CVSS 7.5) in its file transfer and virtual clipboard features. Authenticated session attackers could write files to arbitrary locations on disk — a primitive that's trivial to escalate into remote code execution. Patch to 15.81.5 now.

The Disclosure

On August 26, 2026, TeamViewer published security bulletin TV-2026-1008 disclosing CVE-2026-16444, affecting TeamViewer Desktop Clients across Windows, macOS, and Linux. It impacts Full Client, Host, and QuickSupport components across TeamViewer Remote, Tensor, and ONE deployments.

Root Cause: CWE-73 Path Traversal

The vulnerability lives in two features developers rarely think of as an attack surface: standard file transfer and the virtual file clipboard. TeamViewer's desktop clients failed to sanitize filenames supplied by a remote peer before writing files to disk. A crafted filename using traversal sequences (../../../) or an absolute path could redirect the write operation completely outside the configured download directory.

Why Arbitrary File Write Matters More Than It Sounds

This isn't RCE in the classic sense — there's no memory corruption, no exploit chain, no shellcode. It's simpler and in some ways scarier: an arbitrary file write primitive. Once an attacker can control where a file lands, they don't need much else. Common escalation paths include:

Dropping a .lnk shortcut into the Windows Startup folder — executes on next login
Planting a malicious DLL where an application's unsafe search order will load it
Writing a crontab entry or systemd unit file into a Linux ~/.config autostart path
Overwriting a configuration file that alters a trusted process's behavior

Attack Prerequisites

Exploitation requires the attacker to be an authenticated participant in an active TeamViewer session — this isn't unauthenticated, drive-by exploitation. Realistic attack vectors include:

Stolen or phished TeamViewer credentials (increasingly common via infostealer logs)
Malicious insiders or compromised third-party support vendors
Tech-support social engineering scams where the victim initiates the session

In all three cases, there's no UAC prompt, no AV alert — just a file transfer notification while the actual file lands somewhere it shouldn't.

Affected Versions

Vulnerable below 15.81.5 (current release), 15.64.7 (Win 7/8), 14.7.48833/14.7.48838 (v14 Windows/Linux-macOS), and separate v13 builds per OS. If you manage TeamViewer via Tensor policy, verify actual client versions on endpoints — central policy doesn't guarantee every install is patched.

Detection Queries for Blue Teams

Cross-reference TeamViewer connection logs against Sysmon Event ID 11 (FileCreate):

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=11} -MaxEvents 50 | Where-Object {$_.Message -match 'Startup'}

This pulls recent FileCreate events referencing Startup paths, useful for correlating suspicious file writes against session timestamps during triage.

Remediation Checklist

Patch to 15.81.5 or your legacy branch's fixed build
Enforce MFA on all TeamViewer accounts
Disable file transfer/clipboard sync where operationally unnecessary
Monitor startup/autorun locations via EDR
Audit third-party/MSP client endpoints, not just internal fleet

TeamViewer credited researchers Jamir0quai and sam91281 for responsible disclosure via its bug bounty program, and states there's no evidence of in-the-wild exploitation prior to the patch.

Full technical writeup with attack scenarios and version chart:
https://www.xpert4cyber.com/2026/08/teamviewer-vulnerability-cve-2026-16444-rce.html