CVE-2026-23569: TeamViewer DEX Client DoS Vulnerability

CVE-2026-23569 Overview

An out-of-bounds read vulnerability exists in the TeamViewer DEX Client (formerly 1E Client) - Content Distribution Service (NomadBranch.exe) prior to version 26.1 for Windows. This vulnerability allows a remote attacker on an adjacent network to leak stack memory and cause a denial of service via a crafted request. The leaked stack memory could be used to bypass Address Space Layout Randomization (ASLR) remotely and facilitate exploitation of other vulnerabilities on the affected system.

Critical Impact

This vulnerability enables attackers to leak sensitive stack memory information that can be leveraged to bypass ASLR protections, potentially enabling more sophisticated follow-up attacks. Additionally, exploitation can cause denial of service conditions affecting content distribution operations.

Affected Products

• TeamViewer DEX Client for Windows (versions prior to 26.1)
• TeamViewer Content Distribution Service (NomadBranch.exe) prior to version 26.1
• Former 1E Client installations with vulnerable NomadBranch service

Discovery Timeline

• 2026-01-29 - CVE-2026-23569 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-23569

Vulnerability Analysis

This out-of-bounds read vulnerability (CWE-125) affects the Content Distribution Service component of TeamViewer DEX Client for Windows. The vulnerability resides in the NomadBranch.exe service, which handles content distribution requests across the network.

When processing specially crafted requests, the service fails to properly validate buffer boundaries before reading memory. This allows an attacker to read beyond the intended buffer limits, exposing stack memory contents to the attacker. The exposed memory can contain sensitive information including memory addresses that could be used to defeat ASLR protections.

The adjacent network attack vector means that exploitation requires the attacker to be on the same network segment as the target system. While this limits the attack surface compared to internet-facing vulnerabilities, it presents significant risk in enterprise environments where lateral movement is a common attack technique.

Root Cause

The vulnerability stems from improper input validation in the request handling logic of the NomadBranch.exe service. When parsing incoming requests, the service does not adequately verify that requested data lengths fall within valid buffer boundaries. This boundary condition error allows attackers to specify read operations that extend beyond allocated memory regions, resulting in the disclosure of adjacent stack memory.

Attack Vector

Exploitation of this vulnerability requires an attacker positioned on an adjacent network to send specially crafted requests to the vulnerable NomadBranch.exe service. The attack flow involves:

1. The attacker identifies a system running a vulnerable version of TeamViewer DEX Client
2. A malicious request is crafted with parameters designed to trigger the out-of-bounds read condition
3. The service processes the request without proper boundary checks
4. Stack memory beyond the intended buffer is read and returned in the response
5. The attacker can analyze leaked memory to identify ASLR base addresses
6. This information can then be used to craft more reliable exploits against other vulnerabilities

The vulnerability can also be exploited purely for denial of service, causing the service to crash and disrupting content distribution operations.

Detection Methods for CVE-2026-23569

Indicators of Compromise

• Unexpected crashes or restarts of the NomadBranch.exe service
• Anomalous network traffic patterns targeting the Content Distribution Service ports
• Unusual memory access patterns or segmentation faults logged by the service
• Multiple connection attempts from single sources to the NomadBranch service

Detection Strategies

• Monitor for abnormal request patterns to the TeamViewer DEX Client Content Distribution Service
• Deploy network intrusion detection rules to identify malformed requests targeting NomadBranch.exe
• Enable verbose logging on TeamViewer DEX Client services to capture suspicious activity
• Implement endpoint detection and response (EDR) monitoring for the NomadBranch.exe process

Monitoring Recommendations

• Configure alerts for service crashes or unexpected terminations of NomadBranch.exe
• Monitor network traffic on adjacent network segments for reconnaissance activity targeting TeamViewer services
• Review Windows Event Logs for application errors related to the Content Distribution Service
• Implement SentinelOne's behavioral analysis to detect exploitation attempts and memory anomalies

How to Mitigate CVE-2026-23569

Immediate Actions Required

• Update TeamViewer DEX Client to version 26.1 or later immediately
• If immediate patching is not possible, consider temporarily disabling the Content Distribution Service
• Implement network segmentation to limit adjacent network access to systems running vulnerable versions
• Monitor affected systems for signs of exploitation until patches are applied

Patch Information

TeamViewer has released version 26.1 of the DEX Client which addresses this vulnerability. Organizations should download and apply this update from official TeamViewer channels. For detailed patch information, refer to the TeamViewer Security Bulletin TV-2026-1001.

Workarounds

• Restrict network access to the NomadBranch.exe service using firewall rules to limit exposure
• Implement network segmentation to isolate systems running TeamViewer DEX Client from untrusted network segments
• Deploy intrusion prevention systems (IPS) to detect and block malformed requests targeting the service
• Consider disabling the Content Distribution Service temporarily if it is not business-critical until patches can be applied

# Configuration example - Restrict NomadBranch service access via Windows Firewall
netsh advfirewall firewall add rule name="Block NomadBranch External" dir=in action=block program="%ProgramFiles%\TeamViewer\NomadBranch.exe" remoteip=any
netsh advfirewall firewall add rule name="Allow NomadBranch Trusted" dir=in action=allow program="%ProgramFiles%\TeamViewer\NomadBranch.exe" remoteip=<trusted_subnet>