An out‑of‑bounds read is present in the TeamViewer DEX Client’s Content Distribution Service (NomadBranch.exe) on all Windows platforms prior to version 26.1. A crafted network packet sent from an adjacent system can trigger a memory read beyond the allocated buffer, exposing raw memory contents and potentially enabling an attacker to bypass address‑space layout randomization for subsequent exploitation. The vulnerability can also lead to a denial of service if the read causes the client to crash or become unresponsive.

The affected product is the TeamViewer Digital Employee Experience (DEX) Client, formerly the 1E Client, version 26.1 and earlier on Microsoft Windows. Only the Windows distribution of NomadBranch.exe is impacted; other operating systems are not currently affected.

With a CVSS score of 5.4 the risk is considered medium. The EPSS score is less than 1 %, indicating a very low probability of exploitation from the public SaaS data set. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malformed packet injected over the local or adjacent network, requiring network proximity to the victim’s machine and the DEX client to be actively running.