An out-of-bounds read was discovered in the TeamViewer DEX Client (formerly 1E Client) Content Distribution Service (NomadBranch.exe). The flaw permits an attacker that can send a crafted request to trigger the read, exposing stack memory that can be used to bypass address space layout randomization and to crash the application, resulting in a denial of service. The weakness is classified as CWE‑125.

The vulnerability affects the TeamViewer Digital Employee Experience (DEX) Client for Windows prior to version 26.1. Administrators should verify whether NomadBranch.exe is deployed on their Windows endpoints, as it is the component that processes external requests. Windows operating systems serve as the host, but the bug is specific to the DEX client binary.

The CVSS score of 6.5 indicates a medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote, via a network request to the vulnerable service; an attacker does not need local privileges. If exploited, the primary impact would be memory disclosure and service disruption, and the leaked data could facilitate further attacks such as ASLR bypass at the host.