An integer underflow occurs in the UDP command handler of the TeamViewer Digital Employee Experience client, exposing a heap‑based buffer overflow that can be triggered by crafted packets sent over UDP. The overflow leads to a service crash, resulting in an unavailability of the Content Distribution Service and denial of service for users who rely on the client.

The affected product is the TeamViewer DEX Client (formerly 1E Client) for Windows, versions prior to 26.1. The vulnerability applies to installations running on Windows operating systems where the NomadBranch.exe service listens for UDP traffic.

With a CVSS score of 6.5 and an EPSS probability of less than 1%, the risk is moderate, and the vulnerability is not currently listed in CISA's KEV catalog. The attack vector requires an adjacent network attacker to send specially crafted UDP packets to the service; no public exploit code is referenced, but the buffer overflow can be triggered by an attacker controlling that network.