CVE-2026-23567: TeamViewer DEX Client DoS Vulnerability

CVE-2026-23567 Overview

CVE-2026-23567 is an integer underflow vulnerability in the UDP command handler of the TeamViewer DEX Client (formerly known as 1E Client) Content Distribution Service (NomadBranch.exe). This vulnerability affects versions prior to 26.1 for Windows and can be exploited by an adjacent network attacker to trigger a heap-based buffer overflow, resulting in a denial-of-service condition through a service crash.

Critical Impact

Adjacent network attackers can crash the TeamViewer DEX Client Content Distribution Service via specially crafted UDP packets, disrupting content distribution operations across enterprise environments.

Affected Products

• TeamViewer DEX Client (formerly 1E Client) for Windows prior to version 26.1
• Content Distribution Service (NomadBranch.exe) component
• Enterprise deployments using TeamViewer DEX for content distribution

Discovery Timeline

• 2026-01-29 - CVE-2026-23567 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-23567

Vulnerability Analysis

This vulnerability (classified as CWE-122: Heap-based Buffer Overflow) originates from an integer underflow condition in the UDP command handler of the NomadBranch.exe service. When processing incoming UDP packets, the service performs arithmetic operations on user-controlled size values without proper validation. An integer underflow occurs when a subtraction operation results in a value that wraps around to a very large positive number due to unsigned integer representation.

The subsequent memory allocation or copy operation uses this incorrectly calculated size, leading to a heap-based buffer overflow. In this case, the overflow manifests as a denial-of-service condition where the service crashes, rather than enabling arbitrary code execution.

Root Cause

The root cause is improper validation of size parameters in UDP packet processing within the Content Distribution Service. The code fails to check for potential underflow conditions before performing arithmetic operations on packet length fields. When an attacker provides specially crafted values that cause the size calculation to underflow, the resulting large value corrupts heap memory, leading to service instability and crash.

Attack Vector

The attack requires adjacency to the target network, meaning the attacker must be on the same local network segment as the vulnerable system. The exploitation involves:

1. Network Positioning: The attacker establishes presence on the same network segment as systems running the TeamViewer DEX Client
2. UDP Packet Crafting: Malicious UDP packets are constructed with size field values designed to trigger the integer underflow condition
3. Service Targeting: The crafted packets are sent to the NomadBranch.exe service listening for UDP commands
4. Crash Triggering: Upon processing the malicious packet, the integer underflow causes heap corruption, resulting in service termination

The vulnerability does not require authentication or user interaction, making it relatively straightforward to exploit once network adjacency is achieved. However, the impact is limited to availability disruption without confidentiality or integrity consequences.

Detection Methods for CVE-2026-23567

Indicators of Compromise

• Unexpected crashes or restarts of the NomadBranch.exe service
• Abnormal UDP traffic patterns targeting TeamViewer DEX Client service ports
• Windows Event Log entries indicating application crashes in NomadBranch.exe
• Repeated service failure events correlating with external network activity

Detection Strategies

• Monitor for anomalous UDP packet sizes or malformed packets targeting the Content Distribution Service
• Implement network intrusion detection rules to identify potential exploitation attempts against TeamViewer DEX services
• Configure endpoint detection to alert on repeated NomadBranch.exe service crashes
• Enable enhanced logging for the TeamViewer DEX Client to capture packet handling errors

Monitoring Recommendations

• Deploy network segmentation monitoring to detect unauthorized adjacent network access attempts
• Configure SIEM correlation rules for patterns of service crashes followed by network anomalies
• Establish baseline UDP traffic patterns for TeamViewer DEX services to identify deviations
• Monitor Windows Application Event Logs for fault bucket entries related to NomadBranch.exe

How to Mitigate CVE-2026-23567

Immediate Actions Required

• Update TeamViewer DEX Client to version 26.1 or later immediately
• Implement network segmentation to restrict access to systems running vulnerable versions
• Consider temporarily disabling the Content Distribution Service on critical systems until patches can be applied
• Review and restrict network access policies to limit adjacent network exposure

Patch Information

TeamViewer has released version 26.1 of the DEX Client which addresses this vulnerability. Organizations should download and deploy the updated version from TeamViewer's official channels. For detailed patch information, refer to the TeamViewer Security Bulletin TV-2026-1001.

Workarounds

• Implement firewall rules to restrict UDP traffic to the NomadBranch.exe service from untrusted network segments
• Deploy network access control (NAC) solutions to prevent unauthorized devices from accessing network segments with vulnerable systems
• Enable host-based firewalls on Windows systems running the DEX Client to filter incoming UDP connections
• Consider isolating content distribution infrastructure in dedicated VLANs with strict access controls

# Windows Firewall rule to restrict UDP access to NomadBranch.exe
netsh advfirewall firewall add rule name="Block Untrusted UDP to DEX Client" dir=in action=block protocol=UDP program="%ProgramFiles%\TeamViewer\DEX\NomadBranch.exe" remoteip=any
# Allow only from trusted management subnet
netsh advfirewall firewall add rule name="Allow Trusted UDP to DEX Client" dir=in action=allow protocol=UDP program="%ProgramFiles%\TeamViewer\DEX\NomadBranch.exe" remoteip=10.0.0.0/8