TeamViewer DEX Client up to 26.0 on Windows Content Distribution Service NomadBranch.exe heap-based overflow

Summaryinfo

A vulnerability was found in TeamViewer DEX Client up to 26.0 on Windows. It has been declared as critical. Impacted is an unknown function of the file NomadBranch.exe of the component Content Distribution Service. Such manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2026-23567. The attack needs to be initiated within the local network. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in TeamViewer DEX Client up to 26.0 on Windows. Affected by this issue is some unknown processing of the file NomadBranch.exe of the component Content Distribution Service. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network attacker to trigger a heap-based buffer overflow and cause a denial-of-service (service crash) via specially crafted UDP packets.

The weakness was published with Bank of America. The advisory is available at teamviewer.com. This vulnerability is handled as CVE-2026-23567 since 01/14/2026. The exploitation is known to be easy. Access to the local network is required for this attack to succeed. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 26.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• TeamViewer

Name

• DEX Client

Version

• 26.0

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion