User-Controlled Value Validation Issue in TeamViewer DEX Client for Windows
CVE-2026-23570

6.5MEDIUM

Key Information:

Vendor

Teamviewer

Status
Dex
Vendor
CVE Published:
29 January 2026

What is CVE-2026-23570?

A flaw in the TeamViewer DEX Client's Content Distribution Service (NomadBranch.exe) allows adjacent network attackers to manipulate log timestamps. Specifically, the absence of validation for user-controlled values permits the exploitation of crafted UDP Sync commands. This may lead to the generation of forged or nonsensical datetime prefixes, ultimately jeopardizing the integrity of log files and complicating forensic analysis.

Affected Version(s)

DEX Windows 0 < 26.1

References

https://www.teamviewer.com/en/resources/trust-center/secu...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Threat Hunt Team of Bank of America
.