CVE-2025-44016

A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing a valid hash for a malicious file, an attacker can cause the service to incorrectly validate and process the file as trusted, enabling arbitrary code execution under the Nomad Branch service context.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1005/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en TeamViewer DEX Client (anteriormente cliente 1E) - Servicio de Distribución de Contenido (NomadBranch.exe) anterior a la versión 25.11 para Windows permite a actores maliciosos eludir la validación de integridad de archivos a través de una solicitud manipulada. Al proporcionar un hash válido para un archivo malicioso, un atacante puede hacer que el servicio valide y procese incorrectamente el archivo como de confianza, lo que permite la ejecución de código arbitrario bajo el contexto del servicio Nomad Branch.

Information

Published : 2025-12-11 12:16

Updated : 2026-10-08 10:10

NVD link : CVE-2025-44016

Mitre link : CVE-2025-44016

CVE.ORG link : CVE-2025-44016

JSON object : View

Products Affected

microsoft

windows

teamviewer

digital_employee_experience

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2025-44016", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-44016", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T17:20:04.181566Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@teamviewer.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@teamviewer.com", "affectedData": [{"vendor": "TeamViewer", "modules": ["Content Distribution Service", "NomadBranch.exe"], "product": "DEX", "versions": [{"status": "affected", "version": "0", "lessThan": "25.11.0.29", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "HF-PLTPKG-524", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "25.9.0.46"}, {"status": "affected", "changes": [{"at": "HF-PLTPKG-526", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "25.5.0.53"}, {"status": "affected", "changes": [{"at": "HF-PLTPKG-525", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "24.5.0.69"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2025-12-11T12:16:25.137", "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1005/", "tags": ["Vendor Advisory"], "source": "psirt@teamviewer.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@teamviewer.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing a valid hash for a malicious file, an attacker can cause the service to incorrectly validate and process the file as trusted, enabling arbitrary code execution under the Nomad Branch service context."}, {"lang": "es", "value": "Una vulnerabilidad en TeamViewer DEX Client (anteriormente cliente 1E) - Servicio de Distribuci\u00f3n de Contenido (NomadBranch.exe) anterior a la versi\u00f3n 25.11 para Windows permite a actores maliciosos eludir la validaci\u00f3n de integridad de archivos a trav\u00e9s de una solicitud manipulada. Al proporcionar un hash v\u00e1lido para un archivo malicioso, un atacante puede hacer que el servicio valide y procese incorrectamente el archivo como de confianza, lo que permite la ejecuci\u00f3n de c\u00f3digo arbitrario bajo el contexto del servicio Nomad Branch."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8611FFE2-869F-435C-8FC2-8522C656D4EA", "versionEndExcluding": "25.11"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@teamviewer.com"}