Security readout for executives and security teams
Plain-English summary
CVE-2026-23568 affects the TeamViewer DEX Client, formerly 1E Client, Content Distribution Service on Windows before version 26.1. An attacker on the same or adjacent network could send a crafted packet that may expose process memory or crash the service. This is not reported as actively exploited in the provided sources.
Executive priority
Treat this as a moderate-priority endpoint exposure issue. It is not described as internet-routable or actively exploited, but the no-auth adjacent-network requirement makes patching important in less trusted network environments, offices, labs, or shared segments.
Technical view
The vulnerability is an out-of-bounds read in NomadBranch.exe, the Content Distribution Service component of TeamViewer DEX Client for Windows before 26.1. CVSS 3.1 is 5.4: adjacent-network, low complexity, no privileges, no user interaction, with low confidentiality and availability impact. Leaked memory could help bypass ASLR and support later exploitation.
Likely exposure
Exposure is most relevant where Windows endpoints run TeamViewer DEX Client or legacy 1E Client with NomadBranch.exe before version 26.1 and are reachable from adjacent network segments. Internet exposure is not indicated by the CVSS vector or description.
Exploitation context
The CVE requires adjacent-network access and a specially crafted packet. The reported outcomes are information disclosure and denial of service. The sources do not state public exploit availability or active exploitation, and CISA KEV status is false in the provided bundle.
Researcher notes
The affected component is NomadBranch.exe in TeamViewer DEX Client Content Distribution Service before 26.1 on Windows. The weakness is CWE-125. The ASLR-bypass note increases chaining relevance, but the cited material does not provide exploitation details, indicators, or evidence of exploitation in the wild.
Mitigation direction
- Upgrade TeamViewer DEX Client for Windows to version 26.1 or later if applicable.
- Check TeamViewer security bulletin TV-2026-1001 for current vendor guidance.
- Limit adjacent-network reachability to systems running NomadBranch.exe where possible.
- Prioritize remediation on shared, untrusted, or broadly accessible network segments.
Validation and detection
- Inventory Windows endpoints running TeamViewer DEX Client or former 1E Client.
- Confirm whether NomadBranch.exe is present and identify the installed client version.
- Flag installations before version 26.1 for remediation review.
- Verify network segmentation limits adjacent access to affected endpoints.
- Monitor vendor advisories for updates to affected versions or mitigations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23568 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L2.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.