CVE-2025-46266: TeamViewer DEX Information Disclosure Flaw

CVE-2025-46266 Overview

CVE-2025-46266 affects the TeamViewer Digital Employee Experience (DEX) Client, formerly known as the 1E Client, on Windows systems. The vulnerability resides in the Content Distribution Service component (NomadBranch.exe) in versions prior to 25.11. An attacker on an adjacent network can coerce the service into transmitting data to an arbitrary internal IP address. This behavior enables information disclosure by redirecting service traffic to attacker-controlled destinations within the internal network. TeamViewer published security bulletin TV-2025-1005 addressing the issue.

Critical Impact
An adjacent-network attacker can force NomadBranch.exe to send sensitive content to an arbitrary internal IP address, resulting in confidentiality loss without authentication or user interaction.

Affected Products

TeamViewer Digital Employee Experience (DEX) Client (formerly 1E Client) for Windows, versions prior to 25.11
TeamViewer DEX Content Distribution Service (NomadBranch.exe)
Microsoft Windows hosts running the affected client

Discovery Timeline

2025-12-11 - CVE-2025-46266 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46266

Vulnerability Analysis

The flaw is an input validation weakness classified under [CWE-20] within the Content Distribution Service of the TeamViewer DEX Client. NomadBranch.exe handles peer-to-peer content distribution across enterprise endpoints. The service accepts request parameters that influence where distribution data is transmitted. Insufficient validation of destination address inputs lets a malicious actor on the same network segment specify arbitrary internal IPs as data recipients. The service then forwards content that should remain scoped to authorized peers, exposing information to unintended systems.

Root Cause

The root cause is improper validation of destination address parameters processed by NomadBranch.exe. The service trusts client-supplied targeting information without enforcing that the destination belongs to a legitimate peer or authorized subnet. This missing constraint permits redirection of transmissions to attacker-selected internal endpoints.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reach the Content Distribution Service from the same broadcast domain or logically adjacent segment. No authentication and no user interaction are required. The attacker sends crafted requests to NomadBranch.exe that specify an arbitrary internal IP as the transmission target. The service honors the request and forwards data to the attacker-controlled listener. The impact is limited to confidentiality; integrity and availability are not affected.

Refer to the TeamViewer Security Bulletin TV-2025-1005 for vendor technical details. No public proof-of-concept exploit is available at time of publication.

Detection Methods for CVE-2025-46266

Indicators of Compromise

Outbound connections from NomadBranch.exe to internal IP addresses that are not registered DEX peers or distribution points
Unexpected content-transfer sessions initiated by the Content Distribution Service to hosts outside the documented distribution topology
Repeated adjacent-network requests to the NomadBranch service port from a single source host

Detection Strategies

Inventory Windows endpoints running TeamViewer DEX Client and identify installations below version 25.11
Baseline normal NomadBranch.exe peer communication patterns and alert on deviations to non-peer internal addresses
Correlate process telemetry from NomadBranch.exe with network flow data to identify anomalous destination IPs

Monitoring Recommendations

Log and review Content Distribution Service network activity at the host and network layer
Monitor east-west traffic on segments hosting DEX clients for unauthorized listeners receiving content transfers
Track version compliance of the DEX Client fleet and alert on hosts that remain on vulnerable builds after patch rollout

How to Mitigate CVE-2025-46266

Immediate Actions Required

Upgrade all TeamViewer DEX Client (former 1E Client) installations on Windows to version 25.11 or later
Identify all hosts running NomadBranch.exe and prioritize patching on systems handling sensitive content
Restrict access to the Content Distribution Service to trusted management subnets using host and network firewalls

Patch Information

TeamViewer addressed CVE-2025-46266 in DEX Client version 25.11 for Windows. Apply the fixed release as documented in the TeamViewer Security Bulletin TV-2025-1005. No workaround replaces installation of the patched version.

Workarounds

Segment DEX Client hosts onto dedicated VLANs to reduce the population of adjacent systems capable of reaching NomadBranch.exe
Enforce Windows Defender Firewall rules that limit inbound connections to the Content Distribution Service to known distribution peers
Disable the Content Distribution Service on endpoints that do not require peer-to-peer content distribution until the patch is applied

bash

# Example: Restrict inbound access to NomadBranch service on Windows
# Replace <TRUSTED_SUBNET> with your authorized DEX distribution range
New-NetFirewallRule -DisplayName "Restrict NomadBranch Inbound" `
  -Direction Inbound `
  -Program "C:\Program Files\1E\Client\NomadBranch.exe" `
  -Action Allow `
  -RemoteAddress <TRUSTED_SUBNET>

New-NetFirewallRule -DisplayName "Block NomadBranch Other" `
  -Direction Inbound `
  -Program "C:\Program Files\1E\Client\NomadBranch.exe" `
  -Action Block